varg-ai
Pass
Audited by Gen Agent Trust Hub on Nov 1, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill includes instructions and scripts to download the Bun runtime from 'https://bun.sh/install'. Bun is a well-known and established technology service, and the use of its official installer is considered a safe and standard procedure for setting up the required environment.
- [REMOTE_CODE_EXECUTION]: The setup script 'scripts/setup.sh' mentions a command to install the Bun runtime via 'curl | bash'. This is provided as instructional text for the user to resolve missing dependencies and is not executed automatically or covertly by the skill. The source 'bun.sh' is a recognized and trusted service.
- [CREDENTIALS_SAFE]: The skill implements robust security measures for handling the 'VARG_API_KEY'. It instructs users to store keys in a local credentials file ('~/.varg/credentials') with restricted permissions ('umask 077') and specifically advises against pasting raw keys into the chat or shell history to prevent leakage. These are considered defensive security best practices.
Audit Metadata