realm
Pass
Audited by Gen Agent Trust Hub on Apr 30, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is designed to provide visual representations of agent activity and ecosystem health without modifying operational data. It adheres to a read-only policy for external data.
- [COMMAND_EXECUTION]: The
serve.pyutility uses the Pythonsubprocessmodule to executegit logandgit statuscommands. This is a legitimate requirement for the skill's primary function of tracking and visualizing repository activity. The implementation follows best practices by passing arguments as a list and avoiding shell execution. - [EXTERNAL_DOWNLOADS]: The visualization templates (
realm-game.html) reference well-known and trusted external resources, including the Phaser game engine via JsDelivr and Google Fonts. These resources are standard for web-based interactive content and do not represent a security risk. - [DATA_EXPOSURE]: The skill reads from local
.agents/and project files, but the data is only used to generate local visualization artifacts or served via a local development server for the user. No unauthorized network exfiltration logic was found.
Audit Metadata