scan-new-specs
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
gh(GitHub CLI) andcurlto interact with GitHub repositories and the Slack API. These are standard operations for a development workflow automation tool. - [EXTERNAL_DOWNLOADS]: Fetches data from official GitHub APIs (
api.github.com) and Slack APIs (slack.com). These are recognized as safe, well-known services within the context of the skill's intended purpose for thewarpdotdevorganization. - [DATA_EXFILTRATION]: The skill transmits repository metadata (PR titles, author names, and emails) to the Slack API to perform user lookups and post notifications. This behavior is documented, limited to internal organization communication (
#growth-docschannel), and uses the environment's existingSLACK_BOT_TOKEN. - [SAFE]: All identified external resources and naming conventions align with the
warpdotdevvendor context (e.g.,warpdotdev/warp,warpdotdev/docs,warpdotdev/warp-server). No obfuscation, privilege escalation, or persistence mechanisms were detected.
Audit Metadata