scrolls-help
Pass
Audited by Gen Agent Trust Hub on Aug 31, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local shell or PowerShell scripts to launch a documentation server when requested by the user via the
-eor--onlineflags. This is restricted to scripts provided within the skill's own directory. - Evidence in
SKILL.md:run bash <skill-dir>/scripts/open_help.sh or pwsh <skill-dir>/scripts/open_help.ps1. - [DYNAMIC_EXECUTION]: A local Python script (
serve_help.py) is used to start a web server that renders the documentation as an HTML page. The server binds only to the local loopback interface (127.0.0.1), ensuring it is not accessible from the network. - Evidence in
scripts/serve_help.py: Useshttp.server.BaseHTTPRequestHandlerandsocketserver.TCPServerto bind to127.0.0.1on an OS-assigned port.
Audit Metadata