github-figure-bed
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses shell scripts to execute the
gh(GitHub CLI) andjqutilities. These tools are used to interact with the GitHub API for repository management, file uploads, and JSON processing. - [DYNAMIC_EXECUTION]: The
setup.shscript employspython3 -cto perform Base64 encoding and decoding. This is a utility function used to handle image content and configuration data in compliance with the GitHub Content API requirements. - [EXTERNAL_DOWNLOADS]: The skill interacts with the official GitHub API (
api.github.com) to manage image hosting. It does not perform unauthorized downloads or execute remote scripts from untrusted sources. - [DATA_EXFILTRATION]: Image files are uploaded to a user-owned GitHub repository. The skill reads the current GitHub user identity via
gh api userand creates/accesses a repository specifically for hosting. No sensitive system data is accessed or exfiltrated.
Audit Metadata