skills/ulpi-io/skills/ship-playbook/Gen Agent Trust Hub

ship-playbook

Pass

Audited by Gen Agent Trust Hub on Jul 16, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONREMOTE_CODE_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs the agent to install external dependencies and agents from the author's GitHub repository (ulpi-io/skills, ulpi-io/agents) using npx commands.
  • [COMMAND_EXECUTION]: Executes arbitrary workspace validation commands (VALIDATE_ALL) and git operations provided via user input or project configuration files like CLAUDE.md.
  • [COMMAND_EXECUTION]: Dynamically generates a shell script (seed-worktree.sh) at runtime and executes it to provision project worktrees with copy-on-write cloning for dependencies.
  • [REMOTE_CODE_EXECUTION]: Orchestrates the delivery process by executing a local JavaScript file (references/workflow-template.js) via the Workflow tool and optionally composing a go-live-audit workflow.
  • [DATA_EXFILTRATION]: Accesses project-specific sensitive files such as .env and status files in .ulpi/workflows/ to manage build environments and track execution progress, though it includes instructions to avoid logging secret values.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 16, 2026, 10:13 AM
Security Audit — agent-trust-hub — ship-playbook