long-term-task-orchestration
Pass
Audited by Gen Agent Trust Hub on Apr 8, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions for installing 'fnm' (Fast Node Manager) from Vercel's official installation script and the Claude CLI from the Anthropic NPM registry. These are well-known services and trusted organizations respectively.
- [COMMAND_EXECUTION]: The orchestration scripts use Node.js's 'child_process.exec' to run CLI commands. To mitigate command injection risks, the skill includes and mandates the use of a 'shellQuote' utility function to sanitize all shell-bound strings.
- [CREDENTIALS_UNSAFE]: The workflow facilitates the setup of an 'ANTHROPIC_API_KEY'. It correctly avoids hardcoding secrets, instead instructing the user to persist keys in a local '.agent.env' file or shell configuration, which is standard practice for developer-oriented CLI tools.
- [REMOTE_CODE_EXECUTION]: The architecture uses the official Claude CLI to launch independent agent sessions for parallel processing. This is the primary intended function of the skill and utilizes the platform's native execution environment.
- [DATA_EXFILTRATION]: No evidence of unauthorized data transmission was found. Network operations are limited to downloading official tools from verified domains like 'vercel.app' and 'npmjs.com'.
Audit Metadata