spend-audit
Pass
Audited by Gen Agent Trust Hub on Jul 31, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references the
webshareCLI available via the official vendor repository on GitHub and a Homebrew tap. These are recognized as legitimate vendor resources for providing the necessary auditing functionality. - [COMMAND_EXECUTION]: The skill is configured to use a specific set of
webshareCLI commands through the Bash tool. The allowed-tools list in the manifest is scoped to data retrieval operations (e.g., list, show, stats, account), aligning with the skill's stated read-only purpose and minimizing the attack surface. - [CREDENTIALS_UNSAFE]: The skill requires a
WEBSHARE_API_KEYto be provided by the user via environment variables. It does not contain hardcoded secrets and follows standard security practices for managing credentials with command-line interfaces. - [DATA_EXFILTRATION]: Account information and usage data retrieved via the CLI are processed locally to generate markdown reports in the
./webshare-audits/directory. No unauthorized network communication or external transmission of sensitive account data was detected.
Audit Metadata