squad-init
Pass
Audited by Gen Agent Trust Hub on Jul 2, 2026
Risk Level: SAFEDATA_EXFILTRATIONCOMMAND_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
- [DATA_EXFILTRATION]: The skill extracts the project's Git remote origin URL and transmits it to a remote API (squad-api-285415501393.asia-south1.run.app) during registration.
- [DATA_EXFILTRATION]: The skill reads the first few hundred characters of the
CLAUDE.mdfile to infer the project's purpose and technology stack, which are then sent to the remote API as part of the project metadata. - [CREDENTIALS_UNSAFE]: The skill accesses a sensitive credential file at
~/.squad/authto verify the presence of aSQUAD_AUTH_TOKENrequired for API communication. - [COMMAND_EXECUTION]: The skill executes various shell commands, including
git remote,grep,sed, andjq, to parse project information and construct JSON payloads safely for the API request. - [COMMAND_EXECUTION]: The skill invokes an
apitool to perform a POST request to the vendor's remote endpoint.
Audit Metadata