raycast-extensions
Pass
Audited by Gen Agent Trust Hub on Jul 22, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides legitimate technical guidance for building software extensions using official platform APIs and established development patterns.
- [CREDENTIALS_UNSAFE]: A hardcoded API key is present in the file
evals/fixtures/dictionary-flawed/src/search.tsx. The content is part of a testing fixture explicitly designed to verify the skill's ability to detect security flaws during automated code reviews. - [COMMAND_EXECUTION]: The skill instructs the agent to use standard development commands, including
npm install,ray lint, andray build, to manage the extension lifecycle. These are standard operations for the intended development use case. - [EXTERNAL_DOWNLOADS]: The skill references and downloads dependencies from the official NPM registry and documentation from established platform domains such as raycast.com and github.com/raycast.
Audit Metadata