readme-skill

Pass

Audited by Gen Agent Trust Hub on May 8, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Fetches user contribution history and language data from GitHub's official API using the gh CLI. This is a standard data retrieval task to populate the developer profile.
  • [COMMAND_EXECUTION]: Uses common command-line utilities including jq, git, and sqlite3 to parse local logs and history. Database queries for Codex data are executed using read-only and immutable flags to prevent modifications to the local environment.
  • [CREDENTIALS_UNSAFE]: Implements a robust redaction mechanism (Step 7) that identifies and scrubs various secrets, such as Anthropic and OpenAI API keys, AWS keys, and GitHub tokens, from the final report before it is saved to disk.
  • [PROMPT_INJECTION]: Processes local chat logs and project titles to identify keywords and collaboration patterns. While this involves reading untrusted content from history files, the skill uses this data for statistical aggregation and keyword extraction rather than direct command execution, minimizing the risk of indirect injection.
Audit Metadata
Risk Level
SAFE
Analyzed
May 8, 2026, 12:55 AM