glean-bk
Pass
Audited by Gen Agent Trust Hub on Jul 27, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads the
glean-bkutility and its associated Homebrew tap from the author's personal GitLab repository namespace (gitlab.com/booking-com/personal/petr.plenkov/). - [COMMAND_EXECUTION]: The instructions execute several shell commands, including
brew tap,brew install,git clone, andmake install-localfor installation. During operation, it invokes thebkCLI (bk genai:mcp tokens) to retrieve authentication tokens. - [CREDENTIALS_UNSAFE]: The skill is designed to handle sensitive OAuth tokens. It extracts these credentials from the
bkcommand and writes them to a local file at~/.glean/tokens.json. The documentation explicitly advises setting restricted file permissions (600) to secure these credentials.
Audit Metadata