setup-warehouse

Pass

Audited by Gen Agent Trust Hub on Oct 16, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses Bash commands to manage temporary session state, timing, and telemetry. It uses uuidgen for session IDs and date for performance timing, which are standard system utilities.
  • [EXTERNAL_DOWNLOADS]: The skill performs network requests to onboarding.confidence.dev and events.eu.confidence.dev to acquire telemetry keys and publish setup progress. These domains are owned by the vendor (Spotify/Confidence) and are used for legitimate product telemetry. The logic includes safeguards to ensure telemetry failures do not block the user experience.
  • [DATA_EXFILTRATION]: While the skill sends data externally, the analysis confirms it only transmits setup metadata (step names, timing, error codes, and conversation sentiment). It explicitly forbids including sensitive information like stack traces, file paths, or credentials in error reports.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 16, 2026, 03:23 PM