gh-fine-grained-pat
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONCREDENTIALS_UNSAFEDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes several CLI tools including
vault,osascript,oathtool, andlsofusingspawnSyncandexecFileSyncto manage tokens, authentication, and system processes. - [CREDENTIALS_UNSAFE]: Personal Access Tokens and TOTP seeds are passed as command-line arguments to external processes (e.g.,
vault set ... <token>andoathtool --totp -b <seed>), which can expose sensitive data to other users via process monitoring tools. Additionally,webauth-agent.mjscreates an unauthenticated Unix domain socket in the public temporary directory to cache decrypted credentials in RAM, potentially allowing other local processes to access them. - [DYNAMIC_EXECUTION]: The skill uses Playwright and the Chrome DevTools Protocol (CDP) to programmatically manipulate the browser and inject virtual WebAuthn credentials to satisfy GitHub's authentication prompts.
Audit Metadata