make-explainer

Pass

Audited by Gen Agent Trust Hub on Oct 19, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONOBFUSCATION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill provides a scripts/doctor.mjs utility to manage necessary system dependencies and sister skills.
  • It can download and install Node.js packages using npm ci.
  • It can install additional skills (make-diagram, make-dashboard, make-motion) from the author's repository (abhijitbansal/claude-skills) using the npx skills command.
  • It can trigger the installation of system utilities like ffmpeg using brew (macOS) or winget (Windows).
  • It supports fetching an optional hero image from a user-configured HTTPS API endpoint.
  • [COMMAND_EXECUTION]: The skill executes various system commands to gather data and build artifacts.
  • It runs git commands to extract information about the branch, commits, and changed files for documentation purposes.
  • It spawns child processes to render videos using make-motion and to perform automated visual checks on generated HTML files using Playwright.
  • These operations are performed using secure APIs like spawnSync or spawn with argument arrays, which prevents shell command injection.
  • [OBFUSCATION]: A static analysis flag regarding Unicode steganography was identified as a false positive.
  • Regular expressions in scripts/lib/lint.mjs and scripts/lib/fit.mjs include references to the Unicode Tags character range (\u{E0020} through \u{E007F}). Investigation confirms these are used as part of a security feature to identify and remove hidden steganographic characters from user prose, rather than to hide information.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 19, 2026, 06:51 PM