octocode-stats

Pass

Audited by Gen Agent Trust Hub on Jun 18, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The build_dashboard.mjs script uses child_process.spawn to trigger the system's default browser opening command (open on macOS, cmd /c start on Windows, or xdg-open on Linux) to display the generated dashboard. This is standard behavior for a dashboard utility.
  • [EXTERNAL_DOWNLOADS]: The assets/template.html file fetches common UI libraries including ApexCharts, CountUp.js, and Lucide from well-known, public CDNs (jsDelivr, Unpkg). These are used strictly for client-side rendering of the usage dashboard.
  • [SAFE]: The skill implements basic data sanitization by escaping HTML characters when injecting JSON usage statistics into the dashboard template, reducing the risk of accidental script injection in the generated file.
  • [SAFE]: No sensitive file access or network exfiltration patterns were detected. The skill operates on local usage data and configuration files associated with the Octocode MCP environment.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 18, 2026, 04:44 AM
Security Audit — agent-trust-hub — octocode-stats