wizard
Pass
Audited by Gen Agent Trust Hub on Aug 12, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill acts as a template generator for creating interactive setup scripts. It follows security best practices for handling sensitive information by using hidden input prompts for secrets and delegating secret storage to the official GitHub CLI (
gh) or local.envfiles. - [DATA_EXPOSURE]: The skill is designed to manage credentials like API keys. It explicitly instructs the AI to use
ask_secretfor hidden entry andset_secretfor CI-related tokens, ensuring secrets are handled appropriately within the generated script's context. - [COMMAND_EXECUTION]: The
template.shfile includes functions that execute local commands such asgrep,mktemp,mv, andgh. These are used for administrative tasks like updating environment files and configuring repository secrets. It also includes logic to open URLs using system-default browsers (e.g.,xdg-open,open), which is a common utility for developer tools. - [EXTERNAL_DOWNLOADS]: The provided example targets Stripe's official dashboard for API key configuration. This is a well-known service, and the operation involves the user manually copying keys from the official site into the script, rather than the script downloading external code.
Audit Metadata