dev-test-hammerspoon
Pass
Audited by Gen Agent Trust Hub on Jun 22, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the Hammerspoon CLI (
hs) andcliclickto execute Lua scripts and shell commands for UI automation, window management, and process control. - [DATA_EXFILTRATION]: The skill captures screenshots using
screencaptureand reads clipboard contents viahs.pasteboard.getContents(). While these access potentially sensitive data, they are used locally for testing verification as described in the skill's purpose. - [REMOTE_CODE_EXECUTION]: The skill executes Lua code dynamically via
hs -cand runs local script files. This dynamic execution is a core feature of the Hammerspoon integration and does not involve fetching code from remote untrusted sources. - [PROMPT_INJECTION]: The skill reads window titles, menu items, and clipboard contents which could potentially contain malicious instructions (indirect prompt injection) if the application being tested is attacker-controlled. However, the risk is mitigated by the manual testing context.
Audit Metadata