ship-playbook
Pass
Audited by Gen Agent Trust Hub on Jul 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to install external dependencies and agents from the author's GitHub repository (
ulpi-io/skills,ulpi-io/agents) usingnpxcommands. - [COMMAND_EXECUTION]: Executes arbitrary workspace validation commands (
VALIDATE_ALL) and git operations provided via user input or project configuration files likeCLAUDE.md. - [COMMAND_EXECUTION]: Dynamically generates a shell script (
seed-worktree.sh) at runtime and executes it to provision project worktrees with copy-on-write cloning for dependencies. - [REMOTE_CODE_EXECUTION]: Orchestrates the delivery process by executing a local JavaScript file (
references/workflow-template.js) via theWorkflowtool and optionally composing ago-live-auditworkflow. - [DATA_EXFILTRATION]: Accesses project-specific sensitive files such as
.envand status files in.ulpi/workflows/to manage build environments and track execution progress, though it includes instructions to avoid logging secret values.
Audit Metadata