read-trello-tasks
Pass
Audited by Gen Agent Trust Hub on Aug 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The script uses
child_process.execto open a local web browser during the login flow (open,start, orxdg-open). This is a standard and safe implementation for local OAuth authentication. - [EXTERNAL_DOWNLOADS]: The documentation suggests installing the Bun runtime from bun.sh (
curl -fsSL https://bun.sh/install | bash). While this involves piped execution of a remote script, Bun is a widely recognized and well-known development tool, and the download points to its official domain. - [COMMAND_EXECUTION]: The skill uses the
buncommand-line tool to execute its local TypeScript scripts. This is the expected and intended mechanism for the skill's operation. - [SAFE]: The skill implements best practices for secret management by using a
.envfile for API keys and a local.data/directory for tokens, both of which are explicitly gitignored. The instructions also include explicit warnings to the agent not to print or leak these credentials into logs or chat.
Audit Metadata