verification-adapter
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The sample project included in the skill executes local Python scripts using the
subprocessmodule to manage its lifecycle. fixture/verify.pylaunches theservice.pybackground process usingsubprocess.Popenwithstart_new_session=True.fixture/tests/test_contract.pyusessubprocess.runandsubprocess.Popento execute the adapter's CLI commands during the test suite.- All executions are performed using
sys.executableand target specific local files that are part of the skill distribution. - [DYNAMIC_EXECUTION]: The skill implements a strict identity verification mechanism using SHA-256 digests to ensure that the code being executed matches the expected candidate.
fixture/common.pyincludes functions likecandidate_digest()andadapter_digest()that compute cryptographic checksums of the source files.fixture/verify.pyandfixture/product_cli.pyvalidate these digests at runtime, exiting with astale_or_wrong_targeterror if the file content does not match the provisioned identity.- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill performs local network operations but does not connect to external services.
fixture/common.pyandfixture/verify.pyuseurllib.requestto communicate with a local service listening on127.0.0.1.- The system includes explicit redaction logic in
fixture/common.py(evidence_safe_identity) to ensure that ownership tokens and credentials are not stored in the persistent evidence manifests.
Audit Metadata