skill-authoring-sync
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes shell commands such as
git push,git status, andnpx skillsto manage the lifecycle of agent skills. These commands are executed viacmd /candmiseto ensure environment consistency during development. - [EXTERNAL_DOWNLOADS]: It fetches skill definitions and components from the
why8023/agent-skillsrepository on GitHub and usesnpxto execute theskillspackage. These operations are aligned with the skill's stated purpose of centralizing and distributing skill assets. - [DATA_EXPOSURE]: The workflow involves reading local configuration files like
.apm/agent-config.jsonandapm.ymlto identify installation targets and repository settings. The instructions include a specific safeguard advising the agent not to commit private machine paths or login credentials to the public central repository.
Audit Metadata