skills/varghq/skills/varg-ai/Gen Agent Trust Hub

varg-ai

Pass

Audited by Gen Agent Trust Hub on Nov 1, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill includes instructions and scripts to download the Bun runtime from 'https://bun.sh/install'. Bun is a well-known and established technology service, and the use of its official installer is considered a safe and standard procedure for setting up the required environment.
  • [REMOTE_CODE_EXECUTION]: The setup script 'scripts/setup.sh' mentions a command to install the Bun runtime via 'curl | bash'. This is provided as instructional text for the user to resolve missing dependencies and is not executed automatically or covertly by the skill. The source 'bun.sh' is a recognized and trusted service.
  • [CREDENTIALS_SAFE]: The skill implements robust security measures for handling the 'VARG_API_KEY'. It instructs users to store keys in a local credentials file ('~/.varg/credentials') with restricted permissions ('umask 077') and specifically advises against pasting raw keys into the chat or shell history to prevent leakage. These are considered defensive security best practices.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 1, 2026, 12:01 PM