octocode-stats
Pass
Audited by Gen Agent Trust Hub on Jun 18, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The
build_dashboard.mjsscript useschild_process.spawnto trigger the system's default browser opening command (openon macOS,cmd /c starton Windows, orxdg-openon Linux) to display the generated dashboard. This is standard behavior for a dashboard utility. - [EXTERNAL_DOWNLOADS]: The
assets/template.htmlfile fetches common UI libraries including ApexCharts, CountUp.js, and Lucide from well-known, public CDNs (jsDelivr, Unpkg). These are used strictly for client-side rendering of the usage dashboard. - [SAFE]: The skill implements basic data sanitization by escaping HTML characters when injecting JSON usage statistics into the dashboard template, reducing the risk of accidental script injection in the generated file.
- [SAFE]: No sensitive file access or network exfiltration patterns were detected. The skill operates on local usage data and configuration files associated with the Octocode MCP environment.
Audit Metadata