forge-app-builder
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes Python helper scripts (
scripts/create_forge_app.pyandscripts/deploy_forge_app.py) to automate local development tasks. These scripts invoke the Forge CLI (forge) and Node.js tools (npm,node) usingsubprocess.run. The deployment script usesshell=Trueto execute these commands, which is a standard pattern for CLI automation within developer-oriented environments. - [EXTERNAL_DOWNLOADS]: The
scripts/list_templates.pyscript programmatically fetches the current list of official Forge templates from an Atlassian-managed JSON endpoint (forge-templates.us-west-2.prod.public.atl-paas.net). Thepackage-lock.jsonalso correctly identifies Atlassian's own package registry for its Node.js dependencies. These operations are performed against trusted vendor infrastructure. - [SAFE]: The skill implements strong security guardrails. The main instructions (
SKILL.md) and configuration guides (references/environments-and-configuration.md) strictly forbid the agent from requesting, accepting, or storing credentials. It instead directs users to use interactive CLI login flows. The environment attribution script (scripts/forge_env.py) includes sanitization logic to ensure that only valid characters are used in telemetry variables.
Audit Metadata