skills/tkersey/dotfiles/seq/Gen Agent Trust Hub

seq

Warn

Audited by Gen Agent Trust Hub on Mar 18, 2026

Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill is designed to download and install a third-party binary tool named seq from a personal GitHub repository and Homebrew tap.
  • Evidence: The run_seq function in SKILL.md attempts to install software using brew install tkersey/tap/seq and git clone https://github.com/tkersey/skills-zig.
  • [COMMAND_EXECUTION]: The skill performs local compilation and binary installation, which involves executing arbitrary shell commands and modifying the local environment.
  • Evidence: The install_seq_direct function executes zig build -Doptimize=ReleaseSafe and install -m 0755 to place a binary in $HOME/.local/bin/seq.
  • [DATA_EXFILTRATION]: The skill explicitly targets and reads sensitive local directories containing AI interaction histories, session logs, and memory files.
  • Evidence: Multiple commands and the overview section reference reading from ~/.codex/sessions and ~/.codex/memories, which contain private session transcripts and metadata.
  • [REMOTE_CODE_EXECUTION]: The bootstrap process downloads source code from an external repository and immediately compiles and executes it locally.
  • Evidence: The run_seq logic in SKILL.md facilitates the automated fetching and building of the seq utility.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Mar 18, 2026, 11:05 AM
Security Audit — agent-trust-hub — seq