aigo-builder
Pass
Audited by Gen Agent Trust Hub on Nov 4, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill includes an auto-update mechanism in
scripts/check_update.py. It fetches the current version and updates from the official vendor repository (github.com/AI-GO-APP/aigo-app-builder-skill). - [COMMAND_EXECUTION]: Several scripts utilize subprocess calls to perform environment checks and build tasks:
scripts/aigo_cli_check.pyexecutesaigo --versionto verify the local command-line interface.scripts/aigo_typecheck.pyexecutesnpx tscto perform TypeScript semantic validation.scripts/aigo_auth.pyfeatures aruncommand that executes user-specified CLI tools within a configured environment.- [DYNAMIC_EXECUTION]: The test suite (
tests/test_secrets.py) usesexec()andcompile()specifically to validate documented code snippets against the runtime environment during development. - [REMOTE_CODE_EXECUTION]: Automated scanners flagged a
curl | bashpattern inscripts/aigo_cli_check.py. Analysis confirms this is a string constant provided as an installation instruction for the user to set up theaigoCLI from the official vendor repository, rather than a command executed automatically by the agent.
Audit Metadata