MergeCAUTION
The AI Agent Workforce Platform. Run a hundred AI coding agents across your own machines — schedule, isolate, and steer them all from one console.
Overview
The AI Agent Workforce Platform. Run a hundred AI coding agents across your own machines — schedule, isolate, and steer them all from one console.
b0eede23f895OBSERVED · 2026-10-08Trust audit
CAUTIONgrade B · trust 85/100 Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- UNDECLARED (1 observation(s))
- Network
- none-observed
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- none-found
Findings (9)
.agents/skills/arch-check
.agents/skills/gh-merge
.agents/skills/github-gitlab-mirror
.agents/skills/worktree
fileDesc("ChhsaWNlbnNlL3YxL2xpY2Vuc2UucHJvdG8SEHByb3RvLmxpY2Vuc2UudjEitQMKDUxpY2Vuc2VTdGF0dXMSEQoJaXNfYWN0aXZlGAEgASgIEhMKC2xpY2Vuc2Vfa2V5GAIgASgJEhkKEW9yZ2FuaXphdGlvbl9uYW1lGAMgASgJEgwKBHBsYW4YBCABKA.agents/skills/e2e
import { file_codegen_v1_options } from "../../codegen/v1/options_pb.ts";backend/license-gen
Gates applied: no_behavioural_pass.
b0eede23f895full audit observations/trust-audit/skill/agentsmesh__merge.json · Report an issue / request a re-scanAudit history
Every audit this skill has had.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-08 | b0eede23f895 | CAUTION | B | 85 | first audit |
Questions
What does the Merge skill do?
The AI Agent Workforce Platform. Run a hundred AI coding agents across your own machines — schedule, isolate, and steer them all from one console.
Is Merge safe to install?
With care. The audit graded it B (85/100) and found 9 things worth knowing before you trust this skill, listed below with the exact line each was found on.
What can Merge access on my machine?
The audit observed that it reads or writes files. At least one of those is not mentioned in its own description, which is itself a finding. Secrets in the source: none found.
How current is this page?
The grade is for one exact copy of the source (b0eede23f895), read on 2026-10-08. The repository is watched, and a new audit runs when it changes — this is the first audit.