dgrunner-setup

Pass

Audited by Gen Agent Trust Hub on Oct 16, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructions involve downloading and installing the @upstand/dgrunner package from the official NPM registry via npm install -g @upstand/dgrunner or npx @upstand/dgrunner.
  • [COMMAND_EXECUTION]: The skill utilizes several CLI commands to manage the installation and lifecycle of the runner, including dgrunner doctor, dgrunner setup, dgrunner status, and dgrunner ps.
  • [CREDENTIALS_UNSAFE]: The skill manages GitHub registration tokens using secure practices, explicitly instructing the operator to use interactive hidden inputs rather than command-line arguments to avoid exposure in shell history.
  • [PRIVILEGE_ESCALATION]: The skill mentions administrative flags such as --docker-socket, which allows a runner to control the host Docker daemon, and --force for bypassing safety checks. Both options are documented with appropriate warnings about their security implications.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 16, 2026, 02:33 PM