Skills
Navigate
skills/tychohq/agent-skills/gog-safety/Gen Agent Trust Hub

gog-safety

Warn

Audited by Gen Agent Trust Hub on Sep 23, 2026

Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPRIVILEGE_ESCALATIONPERSISTENCEDYNAMIC_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The scripts/build-gog-safe.sh script downloads source code from an external GitHub repository.
  • Evidence: git clone --branch "$UPSTREAM_BRANCH" --depth 1 "$UPSTREAM_REPO" "$BUILD_DIR" where UPSTREAM_REPO is https://github.com/drewburchfield/gogcli-safe.git.
  • [REMOTE_CODE_EXECUTION]: The skill downloads external source code and compiles it into an executable, which is then run to verify its version.
  • Evidence: go build -tags safety_profile -ldflags "$LDFLAGS" -o "$OUTPUT" ./cmd/gog/ followed by "$OUTPUT" --version in scripts/build-gog-safe.sh.
  • [DYNAMIC_EXECUTION]: The build process involves runtime generation of Go source code based on user-selected safety profiles.
  • Evidence: go run ./cmd/gen-safety --strict safety-profile.yaml in scripts/build-gog-safe.sh.
  • [COMMAND_EXECUTION]: The deployment script executes arbitrary shell commands on remote hosts via SSH.
  • Evidence: Multiple instances of ssh "$HOST" "..." in scripts/deploy-gog-safe.sh to manage files and verify installation.
  • [PRIVILEGE_ESCALATION]: The skill requires elevated permissions to install the modified binary into protected system directories.
  • Evidence: sudo mv /tmp/gog-safe-new /usr/local/bin/gog and sudo chmod +x /usr/local/bin/gog in scripts/deploy-gog-safe.sh.
  • [PERSISTENCE]: By installing the modified binary to /usr/local/bin/gog, the skill ensures that all future invocations of the gog command use the newly deployed version.
  • Evidence: Modification of /usr/local/bin/gog in scripts/deploy-gog-safe.sh.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Sep 23, 2026, 06:38 AM