rabbit-rewrites

Pass

Audited by Gen Agent Trust Hub on Aug 30, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides instructions and scripts to run local model servers like llama-server and ollama. These are standard developer tools for running LLMs locally.
  • [REMOTE_CODE_EXECUTION]: While the skill interacts with external LLM endpoints (e.g., OpenRouter, local servers), it does not download or execute arbitrary remote scripts. All model interaction is via standard OpenAI-compatible APIs.
  • [CREDENTIALS_SAFE]: The documentation encourages secure secret management by suggesting the use of environment variables (api_key_env) in configuration files rather than hardcoding raw API keys.
  • [DYNAMIC_EXECUTION]: The test runner (tests/run.py) uses __import__ for test discovery, and the helper module uses importlib.util for dynamic loading of local skill scripts. These are standard practices for lightweight Python test suites and do not involve untrusted remote code.
  • [EXTERNAL_DOWNLOADS]: The documentation provides links and commands for downloading LLM weights from Hugging Face and Ollama. These are well-known, trusted services in the AI ecosystem.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 30, 2026, 10:28 AM
Security Audit — agent-trust-hub — rabbit-rewrites