aigo-builder

Pass

Audited by Gen Agent Trust Hub on Nov 4, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill includes an auto-update mechanism in scripts/check_update.py. It fetches the current version and updates from the official vendor repository (github.com/AI-GO-APP/aigo-app-builder-skill).
  • [COMMAND_EXECUTION]: Several scripts utilize subprocess calls to perform environment checks and build tasks:
  • scripts/aigo_cli_check.py executes aigo --version to verify the local command-line interface.
  • scripts/aigo_typecheck.py executes npx tsc to perform TypeScript semantic validation.
  • scripts/aigo_auth.py features a run command that executes user-specified CLI tools within a configured environment.
  • [DYNAMIC_EXECUTION]: The test suite (tests/test_secrets.py) uses exec() and compile() specifically to validate documented code snippets against the runtime environment during development.
  • [REMOTE_CODE_EXECUTION]: Automated scanners flagged a curl | bash pattern in scripts/aigo_cli_check.py. Analysis confirms this is a string constant provided as an installation instruction for the user to set up the aigo CLI from the official vendor repository, rather than a command executed automatically by the agent.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 4, 2026, 08:42 AM