vos-create
Pass
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
@vosjs/cliand@vosso/vos-pluginto perform operations likevos check,vos still, andvos push. These are standard development workflows for the target platform.- [CREDENTIALS_UNSAFE]: The skill references sensitive environmental variables (VOS_API_KEY) and credential files (~/.config/vos/credentials). However, it contains explicit instructions to never print these in logs, output, or reports. It follows a secure-by-default logic where it uses these tokens forAuthorization: Bearerheaders against the officialvos.soAPI. Standard secret management practices (like using.envor local config files) are used rather than hardcoding actual secrets.- [EXTERNAL_DOWNLOADS]: The skill instructs the installation of official Node.js packages (@vosjs/cli,@vosso/vos-plugin) via npm. These are vendor-owned resources matching the author context ('vosjs').- [SAFE]: All network operations (GET/POST/PUT) are directed to the official domainvos.soand its API subdomains. The logic is focused on content creation and folder management within the user's own account. All generated work is explicitly set to PRIVATE, preventing unauthorized data exposure.
Audit Metadata