remembering

Warn

Audited by Gen Agent Trust Hub on May 7, 2026

Risk Level: MEDIUMREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill implements a mechanism in scripts/utilities.py that retrieves Python code stored in the remote Turso database (tagged as utility-code) and writes it to the local filesystem at ~/muninn_utils/. These scripts are subsequently available for import and execution as functional extensions of the memory system.
  • [COMMAND_EXECUTION]: Standard command-line tools are invoked in scripts/boot.py and scripts/spokes.py using subprocess.run to verify GitHub authentication and interact with the GitHub API via the gh CLI.
  • [SAFE]: The skill includes robust security hardening, such as scripts/turso.py sanitizing error messages to redact Authorization headers and Bearer tokens to prevent accidental leakage in logs.
  • [SAFE]: scripts/utilities.py performs strict path traversal checks and name validation before writing utility scripts to the filesystem, ensuring they remain within the designated utility directory.
  • [SAFE]: Network communication is restricted to the author's Turso database instance and official GitHub API endpoints.
Audit Metadata
Risk Level
MEDIUM
Analyzed
May 7, 2026, 04:35 AM