xapi-provider

Pass

Audited by Gen Agent Trust Hub on Oct 16, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill uses npx xapi-to to fetch and execute the provider CLI tool from the npm registry. This is the primary mechanism for interacting with the xAPI platform and is consistent with the skill's stated purpose and vendor identity.
  • [COMMAND_EXECUTION]: Extensive use of shell commands is required to operate the service lifecycle, including creating services, managing revisions, and publishing updates. These commands are documented with security in mind, using flags like --file to avoid exposing sensitive data in command-line arguments.
  • [SAFE]: The skill includes explicit security guidance for the AI agent, such as instructions to never search the filesystem for credentials, avoid echoing keys, and treat private headers as sensitive data that should not be printed in summaries.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 16, 2026, 07:53 AM