pkgmgr-homebrew-formula-dev
Pass
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: Automated scanning flagged a piped command pattern in SKILL.md as potential remote code execution. Technical review of the evidence (curl ... | shasum) confirms this is a standard and benign operation used to verify the integrity of source tarballs, likely misidentified due to the shell utility substring.
- [EXTERNAL_DOWNLOADS]: The skill instructions guide the agent to download repository archives and release metadata from GitHub to calculate hashes and populate formula fields. These operations are performed on well-known, established development platforms.
- [COMMAND_EXECUTION]: The package includes a justfile that defines recipes for installing project dependencies and executing the formula generation tool. This is a standard automation practice for local development environments.
- [SAFE]: The skill employs security best practices, such as strict JSON Schema validation using the ajv library to ensure input data conforms to expected formats before it is processed by the templating engine. Additionally, the skill provides extensive documentation on bottle attestation and build provenance in the reference directory.
Audit Metadata