env-secrets-manager
Pass
Audited by Gen Agent Trust Hub on May 2, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill includes multiple shell scripts (e.g.,
validate-env.sh,scan-secrets.sh) designed to automate security workflows and manage local system configurations. - [EXTERNAL_DOWNLOADS]: Integrates with and references official tools and repositories from well-known services such as HashiCorp Vault, AWS SSM, Doppler, and 1Password.
- [REMOTE_CODE_EXECUTION]: Utilizes pattern where Bash scripts execute embedded Python logic and dynamically generate Git pre-commit hooks for secret detection.
- [PROMPT_INJECTION]: Presents a surface for indirect prompt injection by processing external data from
.envfiles and Git logs; however, it implements regex-based sanitization and serves a legitimate security purpose. - [DATA_EXFILTRATION]: While the skill interacts with sensitive credentials, all operations are directed toward user-configured, trusted secret management platforms (AWS, Vault, etc.) rather than unauthorized external domains.
Audit Metadata