qa
Warn
Audited by Gen Agent Trust Hub on Aug 1, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONDATA_EXFILTRATIONCREDENTIALS_UNSAFE
Full Analysis
- [COMMAND_EXECUTION]: The skillify module in references/legacy/skillify.md generates and executes TypeScript code on the local machine using the Bun runtime to automate scraping tasks.
- [REMOTE_CODE_EXECUTION]: The runtime-bootstrap.mjs script downloads binary components and installers from the vendor's repository on GitHub and executes them locally to set up optional runtime capabilities.
- [DATA_EXFILTRATION]: The pair-agent module facilitates sharing the local browser environment with remote agents via ngrok tunnels, which includes the generation of access tokens and public exposure of local services.
- [CREDENTIALS_UNSAFE]: The setup-browser-cookies module implements functionality to decrypt and import authenticated session cookies from local Chromium browser installations into the agent's environment.
Audit Metadata