vos-remix
Pass
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill installs official CLI and plugin packages (
@vosjs/cli,@vosso/vos-plugin) from the standard NPM registry. These are verified vendor resources for the 'vosjs' ecosystem and represent standard development dependencies. - [COMMAND_EXECUTION]: The instructions involve executing local CLI commands (
vos fetch,vos check,vos push,vos pull) to interact with the platform. These commands are constrained to the intended purpose of the skill and utilize standard authenticated API interactions. - [CREDENTIALS_SAFE]: The documentation explicitly instructs the agent to NEVER print credentials. It describes standard, secure practices for resolving API keys from environment variables (
VOS_API_KEY) or specific local config files (~/.config/vos/credentials), which is consistent with professional CLI tool behavior. - [REMOTE_CODE_EXECUTION]: While the skill involves pushing JavaScript-as-strings to a platform for rendering, this is the primary functionality of the 'vos' program architecture. The platform performs server-side validation and compilation (as noted in the remix contract), and the skill provides a
vos checkstep for local verification, which mitigates risks of shipping malformed code. - [DATA_EXFILTRATION]: Network operations are limited to communicating with the official vendor domain (
vos.so) for fetching programs and pushing remixes. There are no patterns suggesting exfiltration of sensitive user data to unauthorized third parties.
Audit Metadata