test-health-check-setup
Warn
Audited by Gen Agent Trust Hub on Feb 17, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- COMMAND_EXECUTION (MEDIUM): The skill utilizes
launchctlto install a LaunchAgent in~/Library/LaunchAgents/. This is a persistence mechanism that ensures the script runs daily. While this matches the stated purpose of a "Daily Scheduler," persistence techniques are categorized as high-risk behavior and require user oversight. - EXTERNAL_DOWNLOADS (LOW): The workflow includes a
pip installcommand targeting arequirements.txtfile sourced from an external template. This introduces a risk of installing unverified third-party code into the local environment. - Indirect Prompt Injection (LOW): The skill ingests user input (API keys, webhooks) and interpolates them directly into
.envandconfig.pyfiles. The lack of explicit sanitization or boundary markers for these inputs constitutes an injection surface, though limited to the local system scope. - CREDENTIALS_UNSAFE (SAFE): The skill handles sensitive data by prompting the user for an Intelligems API key and Slack Webhook. It follows security best practices by storing these in a local
.envfile and ensuring a.gitignoreis created to prevent accidental exposure via version control.
Audit Metadata