xapi-provider
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses
npx xapi-toto fetch and execute the provider CLI tool from the npm registry. This is the primary mechanism for interacting with the xAPI platform and is consistent with the skill's stated purpose and vendor identity. - [COMMAND_EXECUTION]: Extensive use of shell commands is required to operate the service lifecycle, including creating services, managing revisions, and publishing updates. These commands are documented with security in mind, using flags like
--fileto avoid exposing sensitive data in command-line arguments. - [SAFE]: The skill includes explicit security guidance for the AI agent, such as instructions to never search the filesystem for credentials, avoid echoing keys, and treat private headers as sensitive data that should not be printed in summaries.
Audit Metadata