dev-dashboard

Warn

Audited by Gen Agent Trust Hub on Mar 31, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONSAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill establishes persistence by installing executable shims (dev-dashboard and dev-dashboard-stop) into the user's local binary directory (~/.local/bin). This allows the dashboard to be launched from any terminal session independently of the AI agent context.
  • [COMMAND_EXECUTION]: The install.sh script employs dynamic execution by generating shell script shims at runtime. It writes logic to a temporary file, applies executable permissions with chmod +x, and moves the resulting files to a persistent path on the system.
  • [COMMAND_EXECUTION]: The start.sh script uses node -e to dynamically evaluate a Javascript snippet for parsing the configuration file and resolving the preferred server port.
  • [COMMAND_EXECUTION]: The skill executes multiple local shell scripts (check-install.sh, install.sh, start.sh) and a bundled Node.js server to perform its primary functions.
  • [SAFE]: The dashboard's HTML file references external font resources from well-known and trusted services (fonts.googleapis.com and fonts.gstatic.com).
Audit Metadata
Risk Level
MEDIUM
Analyzed
Mar 31, 2026, 02:52 PM
Security Audit — agent-trust-hub — dev-dashboard