resonate-bash
Pass
Audited by Gen Agent Trust Hub on Aug 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill facilitates the execution of arbitrary shell scripts on the host, in Docker containers, or in remote sandboxes. This is the primary and intended purpose of the skill, allowing for asynchronous tasks that survive session restarts.\n- [EXTERNAL_DOWNLOADS]: Installation instructions direct the user to download the Resonate binary from the official vendor Homebrew tap (
resonatehq/tap). These are legitimate vendor resources.\n- [PROMPT_INJECTION]: The skill'sscriptparameter allows for the execution of arbitrary commands, which inherently creates a surface for indirect prompt injection if the agent processes untrusted data. However, this capability is the core function of the tool and includes standard transport encoding (Base64).\n- [DATA_EXFILTRATION]: The instructions guide users to provide aTENSORLAKE_API_KEYfor remote execution. The skill author provides explicit security advice to store these credentials in the system Keychain rather than plaintext files for production environments.
Audit Metadata