getting-started
Pass
Audited by Gen Agent Trust Hub on Jul 5, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides legitimate onboarding and troubleshooting steps for the ToughTongue AI plugin. It follows security best practices by instructing users to manage authentication tokens through environment variables rather than direct input into the chat.
- [COMMAND_EXECUTION]: The skill provides users with CLI commands (such as
codex mcp add,claude mcp add, andlaunchctl setenv) to configure their local environment for the MCP server. These are standard configuration steps for the platform and are presented as troubleshooting instructions for the user to run. - [EXTERNAL_DOWNLOADS]: The skill connects to the vendor's official API endpoint (
api.toughtongueai.com) for its MCP server functionality. This is the expected and documented behavior for the ToughTongue AI plugin. - [CREDENTIALS_UNSAFE]: The skill explicitly warns the user: 'NEVER ask the user to paste the token into the chat,' which is a proactive security measure to prevent sensitive data exposure.
Audit Metadata