make-explainer
Pass
Audited by Gen Agent Trust Hub on Oct 19, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONOBFUSCATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides a
scripts/doctor.mjsutility to manage necessary system dependencies and sister skills. - It can download and install Node.js packages using
npm ci. - It can install additional skills (
make-diagram,make-dashboard,make-motion) from the author's repository (abhijitbansal/claude-skills) using thenpx skillscommand. - It can trigger the installation of system utilities like
ffmpegusingbrew(macOS) orwinget(Windows). - It supports fetching an optional hero image from a user-configured HTTPS API endpoint.
- [COMMAND_EXECUTION]: The skill executes various system commands to gather data and build artifacts.
- It runs
gitcommands to extract information about the branch, commits, and changed files for documentation purposes. - It spawns child processes to render videos using make-motion and to perform automated visual checks on generated HTML files using Playwright.
- These operations are performed using secure APIs like
spawnSyncorspawnwith argument arrays, which prevents shell command injection. - [OBFUSCATION]: A static analysis flag regarding Unicode steganography was identified as a false positive.
- Regular expressions in
scripts/lib/lint.mjsandscripts/lib/fit.mjsinclude references to the Unicode Tags character range (\u{E0020}through\u{E007F}). Investigation confirms these are used as part of a security feature to identify and remove hidden steganographic characters from user prose, rather than to hide information.
Audit Metadata