skills/timschoch/skilly/setup-skilly/Gen Agent Trust Hub

setup-skilly

Pass

Audited by Gen Agent Trust Hub on Aug 31, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill uses npx github:timschoch/skilly to fetch and execute code directly from the author's GitHub repository.
  • [REMOTE_CODE_EXECUTION]: Remote code execution is used via npx to perform the primary onboarding and synchronization tasks.
  • [COMMAND_EXECUTION]: The scripts/onboard.js file uses the spawnSync function to execute multiple system commands, including git (for branch creation, commits, and pushes) and the GitHub CLI gh (for secret management and pull request creation).
  • [COMMAND_EXECUTION]: The script reads a private key from a PEM file and configures it as a repository secret using the gh secret set command. This is a documented part of the tool's onboarding workflow for automating GitHub Actions.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 31, 2026, 11:06 PM
Security Audit — agent-trust-hub — setup-skilly