skills/vosjs/skills/vos-create/Gen Agent Trust Hub

vos-create

Pass

Audited by Gen Agent Trust Hub on Aug 26, 2026

Risk Level: SAFECOMMAND_EXECUTIONCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses the @vosjs/cli and @vosso/vos-plugin to perform operations like vos check, vos still, and vos push. These are standard development workflows for the target platform.- [CREDENTIALS_UNSAFE]: The skill references sensitive environmental variables (VOS_API_KEY) and credential files (~/.config/vos/credentials). However, it contains explicit instructions to never print these in logs, output, or reports. It follows a secure-by-default logic where it uses these tokens for Authorization: Bearer headers against the official vos.so API. Standard secret management practices (like using .env or local config files) are used rather than hardcoding actual secrets.- [EXTERNAL_DOWNLOADS]: The skill instructs the installation of official Node.js packages (@vosjs/cli, @vosso/vos-plugin) via npm. These are vendor-owned resources matching the author context ('vosjs').- [SAFE]: All network operations (GET/POST/PUT) are directed to the official domain vos.so and its API subdomains. The logic is focused on content creation and folder management within the user's own account. All generated work is explicitly set to PRIVATE, preventing unauthorized data exposure.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 26, 2026, 07:32 PM
Security Audit — agent-trust-hub — vos-create