skill-authoring-sync

Pass

Audited by Gen Agent Trust Hub on Sep 24, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes shell commands such as git push, git status, and npx skills to manage the lifecycle of agent skills. These commands are executed via cmd /c and mise to ensure environment consistency during development.
  • [EXTERNAL_DOWNLOADS]: It fetches skill definitions and components from the why8023/agent-skills repository on GitHub and uses npx to execute the skills package. These operations are aligned with the skill's stated purpose of centralizing and distributing skill assets.
  • [DATA_EXPOSURE]: The workflow involves reading local configuration files like .apm/agent-config.json and apm.yml to identify installation targets and repository settings. The instructions include a specific safeguard advising the agent not to commit private machine paths or login credentials to the public central repository.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 24, 2026, 07:39 AM