bootgs-quickstart

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The utility script scripts/check-latest-version.sh fetches package metadata from the official npm registry (registry.npmjs.org). This is a standard operation for checking current versions of development dependencies.
  • [COMMAND_EXECUTION]: The skill provides a shell script that uses curl and python3 to facilitate version comparisons. While the script pipes data from a network request to Python, it uses a hardcoded Python command string for static JSON parsing rather than executing remote content.
  • [DYNAMIC_EXECUTION]: The script uses python3 -c to parse local files and process environment variables. The implementation for reading local package.json files uses string interpolation within the command, which is a best-practice violation for input handling but does not present a malicious threat in this context.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 12:47 PM
Security Audit — agent-trust-hub — bootgs-quickstart