setup-skilly
Pass
Audited by Gen Agent Trust Hub on Aug 31, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses
npx github:timschoch/skillyto fetch and execute code directly from the author's GitHub repository. - [REMOTE_CODE_EXECUTION]: Remote code execution is used via
npxto perform the primary onboarding and synchronization tasks. - [COMMAND_EXECUTION]: The
scripts/onboard.jsfile uses thespawnSyncfunction to execute multiple system commands, includinggit(for branch creation, commits, and pushes) and the GitHub CLIgh(for secret management and pull request creation). - [COMMAND_EXECUTION]: The script reads a private key from a PEM file and configures it as a repository secret using the
gh secret setcommand. This is a documented part of the tool's onboarding workflow for automating GitHub Actions.
Audit Metadata