downstream-exports
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill serves as documentation for the 'daodan' build toolchain used to package and export AI agent content to different hosts (Claude, Copilot, Codex, Pi).
- [SAFE]: The described build process includes security measures such as path traversal prevention ('a layout path that escapes its package is refused') and allowlisted template substitution context.
- [SAFE]: References to external tool installation (e.g., 'pi install npm:pi-subagents') and MCP server execution (e.g., 'uv run') are standard configuration patterns for the supported platforms and do not involve untrusted remote code execution or data exfiltration.
Audit Metadata