commandcode-delegate
Pass
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The
relay.mjsscript manages the execution of thecmd(Command Code) CLI andgitbinaries. The implementation uses the Node.jsspawnandexecFileSyncAPIs withshell: false, constructing arguments from validated flags and internal options to prevent shell-based command injection. - [EXTERNAL_DOWNLOADS]: The skill requires the Command Code CLI tool from
commandcode.aito be pre-installed and authenticated on the host system. This external dependency is a functional requirement for the skill's primary purpose and is clearly documented in the compatibility and prerequisite sections. - [DATA_EXPOSURE]: The skill manages the environment variables passed to the implementation process. It includes a
--clean-envflag to restrict the variables inherited by the CLI tool, and the documentation explicitly advises the user on the lack of a filesystem sandbox, recommending manual review of all changes before committing.
Audit Metadata