state-machine
Fail
Audited by Gen Agent Trust Hub on Nov 3, 2026
Risk Level: CRITICALEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill's validation toolchain (scripts/validate-references.sh) uses npm ci to download locked dependencies for linting and testing from the npm registry.
- [COMMAND_EXECUTION]: The validation script (scripts/validate-references.mjs) executes various system tools including gcc, clang, javac, rustc, and shellcheck to verify the correctness of code snippets within the documentation.
- [DYNAMIC_EXECUTION]: Code snippets are extracted from Markdown files, written to temporary directories, and compiled or executed to validate implementation references.
- [SAFE]: The execution of code snippets is protected by a content hashing mechanism in config/validation/snippets.json, which ensures that only pre-approved and hashed code is processed by the validation runner.
Recommendations
- CRITICAL: 1 file(s) identified as malware by FileRep - DO NOT USE
- Contains 2 malicious URL(s) - DO NOT USE
Audit Metadata