walkthrough
Pass
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes a Node.js utility script (
scripts/diff-baseline.mjs) that executes localgitcommands, such asrev-parse,diff, andls-files, to track and compare file changes within the repository. - [SAFE]: The instructions in
SKILL.mdcontain specific security guidelines for protecting sensitive data, explicitly advising users to redact credentials, tokens, and personal information before using image annotation tools. - [SAFE]: The state verification logic in
scripts/diff-baseline.mjsuses SHA256 hashing to compare repository snapshots locally and warns against publishing these hashes to maintain project security. - [SAFE]: The script uses
node:child_process.spawnSyncwith an array of arguments for executing Git commands, which is a secure pattern that prevents shell injection vulnerabilities.
Audit Metadata