skills-panorama

Pass

Audited by Gen Agent Trust Hub on Oct 9, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes local shell scripts and binaries (skill-scan.sh, skills-refiner) to gather information about installed skills. These are established local tools within the agent's environment used for their intended purpose.
  • [SAFE]: The skill strictly enforces a read-only policy. It specifically prohibits outputting commands for deletion, modifying symlinks, or altering control catalogs. All state changes are delegated to separate tools (skill-hygiene) requiring explicit user confirmation.
  • [SAFE]: Data protection is implemented by writing output files (latest.json, latest.md) with restricted 0600 permissions and performing atomic replacements to prevent partial writes. The --share flag includes a robust redaction mechanism for absolute paths, SSH endpoints, and URLs to prevent accidental data exposure when sharing reports.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 9, 2026, 06:43 AM