build-with-univer
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions for cloning official example repositories from GitHub (e.g.,
dream-num/univer-cli-examples) and installing packages from the vendor's specialized registry (insider-npm-registry.univer.work). These resources are managed by the official vendor and are standard for this SDK. - [COMMAND_EXECUTION]: The documentation includes standard shell commands for project setup, such as
pnpm installandpnpm build. Additionally, it provides a Node.js utility snippet that usesexecFileSyncto query package versions vianpm view. These are legitimate developer tools used as intended for dependency management. - [DYNAMIC_EXECUTION]: A utility script is included to help determine compatible package versions by executing
npm view. This represents a local execution of a standard package management command for version resolution rather than arbitrary code execution. - [SAFE]: The skill is primarily educational and architectural documentation. It incorporates numerous security best practices, such as warnings against trusting client-side IDs, implementation of server-side authorization hooks, and the use of iframe sandboxing (without
allow-same-origin) for the Binding SDK.
Audit Metadata