kwcode-local-coding-agent

Pass

Audited by Gen Agent Trust Hub on Apr 30, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill guides the user to install the kwcode package using the standard Python package manager (pip). It provides options for both the official PyPI registry and the well-known Tsinghua University (TUNA) mirror, ensuring users can fetch the necessary software from trusted sources.\n- [COMMAND_EXECUTION]: As a developer tool, the agent is designed to execute local shell commands to fulfill tasks such as running pytest for verification and managing Docker containers for local search indexing. The documentation also describes the use of sys.settrace for runtime debugging to capture variable values during failed attempts, which is a standard diagnostic feature for sophisticated coding agents.\n- [SAFE]: The documentation follows established security best practices for CLI tools, such as advising the use of environment variables for API key management instead of hardcoding credentials. The skill explicitly states that data processing is handled locally, and network operations are limited to user-configured model endpoints and search services.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 30, 2026, 08:58 PM