go
Pass
Audited by Gen Agent Trust Hub on Jul 29, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill generates and executes local bash and Python scripts to perform system diagnostics and skill management tasks. This includes writing temporary scripts to
/tmp/go-list.shand running inline Python for MCP server drift detection. - [EXTERNAL_DOWNLOADS]: Fetches skill definitions and version metadata from the author's official GitHub repository (
Soul-Brews-Studio/arra-oracle-skills-cli). - [REMOTE_CODE_EXECUTION]: Uses
bunxto execute the management CLI tool directly from the author's GitHub repository, ensuring that installations and updates use the most recent skill definitions. - [DATA_EXFILTRATION]: Accesses local session logs (
~/.claude/projects/*/*.jsonl) and configuration files (~/.claude.json) to provide usage statistics and configuration status. No evidence of data exfiltration to unauthorized third parties was found; all network activity is directed to GitHub. - [PROMPT_INJECTION]: The skill processes session logs which could theoretically contain indirect instructions; however, the skill only performs character/string matching for usage counts and does not execute content from these logs.
Audit Metadata