ship
Pass
Audited by Gen Agent Trust Hub on Aug 30, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses
bunxto download and execute the@codewithbeto/shippackage from the NPM registry. - [REMOTE_CODE_EXECUTION]: The execution of
bunx @codewithbeto/shipinvolves running remote code fetched at runtime to scaffold the project. - [COMMAND_EXECUTION]: The skill instructs the agent to run shell commands for project initialization, including
bunxfor scaffolding andbun installfor dependency resolution. - [CREDENTIALS_UNSAFE]: The CLI tool accepts RevenueCat API keys via flags (
--rc-key-ios,--rc-key-android). While these are used for project configuration, providing secrets as command-line arguments is a standard but sensitive practice that can lead to exposure in local logs or process lists.
Audit Metadata