skills/alpoxdev/hypercore/pre-deploy/Gen Agent Trust Hub

pre-deploy

Pass

Audited by Gen Agent Trust Hub on Oct 2, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill automates the execution of local build and linting toolchains within the project directory.
  • Evidence: It uses Bun.spawn to run commands like npm run build, cargo build --release, poetry build, and python -m compileall across the scripts/build-run.mjs and scripts/lint-check.mjs files. These commands are standard for the skill's purpose of verifying deployment readiness.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data in the form of logs and error messages generated by local build tools to diagnose failures and suggest fixes.
  • Ingestion points: Captured stdout and stderr from toolchain commands executed via Bun.spawn in scripts/build-run.mjs and scripts/lint-check.mjs.
  • Boundary markers: The skill utilizes specific instructional blocks (e.g., <instruction_contract>, <workflow>, <argument_validation>) to establish operational constraints and safety boundaries.
  • Capability inventory: The skill relies on the Bash, Write, Edit, and TodoWrite tools to modify project files and re-run validation checks.
  • Sanitization: No explicit sanitization or filtering of log content is implemented; the agent is instructed to use structured reasoning and focus strictly on reproduced failures to mitigate risk.
  • [DYNAMIC_EXECUTION]: The orchestration scripts dynamically assemble shell commands based on the detected project stack and package manager.
  • Evidence: Functions like nodeScriptCommand in scripts/lint-check.mjs and buildCommand in scripts/build-run.mjs construct command arrays at runtime based on the presence of specific configuration files (e.g., package-lock.json, Cargo.toml). This is a standard automation pattern for development environments.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 2, 2026, 01:41 PM