nix-best-practices
Pass
Audited by Gen Agent Trust Hub on Jul 2, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides templates that reference external Nix flake inputs from GitHub, including official NixOS repositories and well-known community organizations such as Numtide. Examples also show the use of
pkgs.fetchurlfor downloading binaries from external sources, which is standard functionality for Nix derivations. - [COMMAND_EXECUTION]: Documentation includes examples of shell commands within Nix
shellHookandinstallPhasesections. These are used for standard environment setup (setting environment variables, echoing status) and package installation (copying files, setting permissions). Common Nix CLI commands (nix-prefetch-url,nix develop) are also documented for user reference. - [DATA_EXFILTRATION]: No sensitive file access or data exfiltration patterns were detected. The documentation mentions standard configuration paths such as
~/.config/nixpkgs/config.nixfor managing legitimate user settings. - [PROMPT_INJECTION]: The skill does not contain any instructions that attempt to override agent behavior, bypass safety guidelines, or extract system prompts.
- [CREDENTIALS_UNSAFE]: No hardcoded credentials or unsafe secret management practices were found. The skill correctly identifies the use of environment variables and configuration files for managing package access.
Audit Metadata