doctor

Pass

Audited by Gen Agent Trust Hub on Sep 8, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill utilizes npx to download and execute the @spotify/portal-cli package from the public NPM registry. This is an expected operation for a diagnostic tool targeting this specific vendor ecosystem.
  • [COMMAND_EXECUTION]: The skill executes local system commands to verify the environment (node --version, npm --version) and plugin status (claude plugin list). It also invokes several subcommands of the @spotify/portal-cli to inspect available actions and authentication status.
  • [CREDENTIALS_UNSAFE]: While the skill interacts with authentication commands (auth list, auth show), it explicitly instructs the agent to never request or print credentials, tokens, or authorization codes, adhering to security best practices for handling sensitive diagnostic data.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 8, 2026, 12:37 AM
Security Audit — agent-trust-hub — doctor