Skills
skills/steveclarke/dotfiles/time-tracking/Gen Agent Trust Hub

time-tracking

Pass

Audited by Gen Agent Trust Hub on May 14, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFE
Full Analysis
  • [COMMAND_EXECUTION]: The Ruby script executes the 1Password CLI tool (op) to securely retrieve API keys for the configured providers. The commands use static references defined within the script, preventing arbitrary command injection.\n- [EXTERNAL_DOWNLOADS]: The skill uses bundler/inline to download and install standard dependencies (thor and httparty) from the official RubyGems registry.\n- [CREDENTIALS_UNSAFE]: API tokens are cached in the user's home directory (~/.local/state/steveos/time-tracking/) with restricted permissions (0600) for a 24-hour period to minimize repeated authentication prompts, which is standard behavior for local CLI utilities.
Audit Metadata
Risk Level
SAFE
Analyzed
May 14, 2026, 01:42 PM
Security Audit — agent-trust-hub — time-tracking