nodejs-cli-aur-packager
Pass
Audited by Gen Agent Trust Hub on Jul 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches package tarballs from the npm registry (registry.npmjs.org). This is an expected operation for an npm-to-AUR packaging tool and involves a well-known service.\n- [COMMAND_EXECUTION]: The skill instructs the agent to execute system commands for packaging, including npm, curl, and makepkg.\n
- It builds and validates packages using makepkg -f and makepkg -si. While makepkg -si involves package installation, it is necessary for the skill's stated purpose of verifying package functionality.\n
- It generates shell wrapper scripts for Node.js command-line interfaces.\n
- It employs security best practices by recommending --ignore-scripts during the dependency installation phase to mitigate risks from untrusted package lifecycle scripts.
Audit Metadata