mocreo-api
Pass
Audited by Gen Agent Trust Hub on Mar 16, 2026
Risk Level: SAFE
Full Analysis
- [CREDENTIALS_UNSAFE]: Secure Secret Management. The skill manages credentials using a local .env file, avoiding hardcoded secrets. It includes a bootstrap script that uses secure terminal entry (getpass) to ensure passwords are never logged or visible in plain text during setup.\n- [PROMPT_INJECTION]: AI Safety Guardrails. The skill instructions contain robust defenses, explicitly forbidding the AI from reading the .env file, guessing platforms, or requesting passwords in the chat interface.\n- [COMMAND_EXECUTION]: Transparent Operations. The AI is mandated to provide a plain-language explanation to the user before executing any local Python script. This ensures the user is informed and provides consent for all actions performed by the agent.\n- [DATA_EXFILTRATION]: Controlled Network Activity. All network communication is restricted to official MOCREO and Sync-Sign API endpoints (api.sync-sign.com and api.mocreo.com) for the sole purpose of device management and data retrieval as requested by the user.\n- [EXTERNAL_DOWNLOADS]: Verified Dependencies. The skill relies on a minimal set of well-known, industry-standard Python libraries (requests, python-dotenv), which are explicitly listed in the requirements.txt file.
Audit Metadata