rabbit-rewrites
Pass
Audited by Gen Agent Trust Hub on Aug 30, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions and scripts to run local model servers like
llama-serverandollama. These are standard developer tools for running LLMs locally. - [REMOTE_CODE_EXECUTION]: While the skill interacts with external LLM endpoints (e.g., OpenRouter, local servers), it does not download or execute arbitrary remote scripts. All model interaction is via standard OpenAI-compatible APIs.
- [CREDENTIALS_SAFE]: The documentation encourages secure secret management by suggesting the use of environment variables (
api_key_env) in configuration files rather than hardcoding raw API keys. - [DYNAMIC_EXECUTION]: The test runner (
tests/run.py) uses__import__for test discovery, and the helper module usesimportlib.utilfor dynamic loading of local skill scripts. These are standard practices for lightweight Python test suites and do not involve untrusted remote code. - [EXTERNAL_DOWNLOADS]: The documentation provides links and commands for downloading LLM weights from Hugging Face and Ollama. These are well-known, trusted services in the AI ecosystem.
Audit Metadata