mega-code-login
Warn
Audited by Gen Agent Trust Hub on Mar 20, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
uv runto execute a Python module. The working directory for this execution is dynamically determined by reading a path from~/.local/share/mega-code/plugin-root, which introduces a dependency on the integrity of that local file.\n- [CREDENTIALS_UNSAFE]: Sensitive API credentials are stored in and retrieved from~/.local/share/mega-code/.env. While the skill masks the API key in its verification output, it involves direct manipulation of secret-bearing files.\n- [COMMAND_EXECUTION]: The skill uses shell commands likecat,grep, andsedto manage configuration and verify stored credentials.
Audit Metadata