a1-yandex-kit-setup
Pass
Audited by Gen Agent Trust Hub on Aug 10, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONCREDENTIALS_UNSAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses
npxto download and execute themcp-yandex-kitpackage from the official NPM registry during token validation and server execution. This is a standard delivery mechanism for MCP servers. - [COMMAND_EXECUTION]: The skill executes local commands to detect installed AI clients, verify Node.js prerequisites, and update configuration files. It mitigates injection risks by using explicit argument arrays and disabling shell execution in its child process spawning logic.
- [DATA_EXFILTRATION]: User-provided Yandex KIT API tokens are transmitted to the official Yandex API endpoint (
api.kit.yandex.net) for the purpose of validating the credentials. The skill includes explicit instructions and helper functions to redact these tokens from error logs and conversation history. - [CREDENTIALS_UNSAFE]: The skill manages user authentication tokens for the Yandex KIT service. It follows security best practices by passing these secrets through standard input (stdin) to avoid exposure in process lists or shell history, and it ensures that configuration files containing these secrets are protected with restrictive filesystem permissions (0600).
Audit Metadata