temporal-cloud-setup
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads the Temporal CLI via the official Homebrew tap ('temporalio/prerelease/temporal-cloud') and clones sample projects from the vendor's GitHub organization ('github.com/temporalio'). These are trusted vendor sources required for the skill's primary function.
- [COMMAND_EXECUTION]: A bundled bash script ('provision.sh') executes shell commands for infrastructure provisioning and project setup. The script uses a static command matrix to map user choices to hardcoded execution strings, which prevents the injection of arbitrary commands into shell execution points.
- [CREDENTIALS_UNSAFE]: The skill handles Temporal Cloud API keys (JWT tokens) using secure practices. It captures tokens directly into memory, utilizes a regex-based redaction function to prevent secrets from appearing in terminal output or logs, and stores configuration in a local 'temporal.toml' file with restricted file permissions (chmod 600) to ensure the credential is only accessible by the local user.
Audit Metadata