colosseum-copilot
Pass
Audited by Gen Agent Trust Hub on Aug 1, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill makes network requests to
https://copilot.colosseum.comto retrieve project data, winner patterns, and research archives. - [COMMAND_EXECUTION]: Uses local shell commands and inline Python snippets to manage its configuration file (
~/.superstack/config.json), log telemetry events, and perform API calls viacurl. - [CREDENTIALS_UNSAFE]: Asks the user for a Personal Access Token (PAT) to authenticate with the Colosseum API. The token is stored locally in the user's configuration directory, which is a standard method for managing API credentials in developer tools.
- [DATA_EXFILTRATION]: Transmits basic telemetry data (skill name, execution phase, status, and platform architecture) to a backend service defined in the local configuration. The telemetry implementation includes an opt-out mechanism and does not transmit PII, source code, or the API token.
Audit Metadata