lore
Pass
Audited by Gen Agent Trust Hub on Jun 12, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is designed for purely local operation. It strictly adheres to a 'Zero dependencies' and 'No network calls' policy as documented in its internal guidelines, ensuring user data remains on the machine.
- [COMMAND_EXECUTION]: The skill executes its own internal Node.js engine scripts (e.g.,
scripts/mine-skills.mjs) to perform deterministic parsing and data management. These executions are scoped to the skill's specific purpose of mining coding history. - [DATA_EXPOSURE]: The skill ingests local session histories to extract workflows. To prevent accidental leakage of sensitive data into generated skills, it includes a mandatory 'Privacy Scrub' phase (Step 5) that identifies and removes secrets, tokens, and private system paths.
- [PROMPT_INJECTION]: The instructions incorporate a robust 'Output Contract' with machine-checkable sentinels. This prevents the agent from skipping the display of evidence and ensures that users only approve skills based on verified transcripts.
- [REMOTE_CODE_EXECUTION]: No remote code execution or external software downloads were identified. The skill is self-contained and does not pull any external dependencies at runtime.
Audit Metadata