report-bug
Pass
Audited by Gen Agent Trust Hub on Mar 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [SAFE]: No malicious behavior or security violations were detected. The skill's operations are consistent with its documented function as a bug reporting tool.
- [COMMAND_EXECUTION]: The skill executes standard system commands to gather technical context for the report, including
uname -afor OS information andclaude --versionfor tool versioning. It also utilizes the GitHub CLI (gh) to submit the final report. - [DATA_EXFILTRATION]: Technical metadata and user-provided bug descriptions are sent to the GitHub repository
EveryInc/compound-engineering-plugin. This data transmission is the primary intended function of the skill and targets a relevant destination for the plugin being supported. - [DATA_EXPOSURE]: The skill reads
~/.claude/plugins/installed_plugins.jsonto identify the version of the compound-engineering plugin. This access is limited to a non-sensitive configuration file used for version verification.
Audit Metadata