tldr
Pass
Audited by Gen Agent Trust Hub on Aug 4, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references a configuration schema hosted on GitHub's raw content service (
raw.githubusercontent.com). This targets a well-known service and belongs to the skill's author context, used for validating tool configuration. - [COMMAND_EXECUTION]: Utilizes read-only git commands (
git status,git diff,git log,git rev-parse) to gather evidence of work performed. It also executes a local, bundled shell script (resolve-config.sh) to process configuration profiles usingjq. These operations are limited to local context gathering. - [SAFE]: The skill implements a 'Secret-free' guardrail that explicitly instructs the agent to scan summarized content (like diffs or environment dumps) and omit tokens or credentials, preventing accidental data exposure in chat logs. It further restricts itself to terminal output only, ensuring no persistent changes are made to the repository.
Audit Metadata