github-repo-management
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses shell commands and Python one-liners to parse JSON data fetched from the official GitHub API. While automated scanners flagged a pattern as piped remote execution, the code actually performs safe JSON parsing (
python3 -c "import sys,json; print(json.load(sys.stdin)['login'])") of data retrieved from a trusted source (api.github.com). - [CREDENTIALS_UNSAFE]: The skill retrieves the
GITHUB_TOKENenvironment variable from standard local configuration files (~/.hermes/.env,~/.git-credentials). This follows established security best practices for secret management by avoiding hardcoded credentials and using existing local configuration.
Audit Metadata