openword-navigator
Pass
Audited by Gen Agent Trust Hub on Mar 10, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill clones its own official repository from 'github.com/dinghuanghao/openword.git' and installs Node.js dependencies using 'npm install'. These are standard setup procedures for the tool's functionality.
- [COMMAND_EXECUTION]: The skill executes local shell and Python scripts ('scripts/openword_rest.sh', 'scripts/openword_rest.py') to interact with a local game server. It uses 'curl' and Python's 'urllib' to send commands to 'http://127.0.0.1:30000'.
- [DATA_EXFILTRATION]: While the skill accesses a 'GEMINI_API_KEY', it follows a standard load order (environment variables, local .env, or user input) and uses it only for its intended purpose within the 'OpenWord' application logic. No unauthorized external transmission of this key was detected.
Audit Metadata