sharedev-init
Warn
Audited by Gen Agent Trust Hub on May 14, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill relies on various shell commands for its core functionality, including
rsyncfor file synchronization andgrep/perlfor searching and modifying files. - [REMOTE_CODE_EXECUTION]: The skill executes
npm install -g @share-crm/sharedev-clito install a global command-line tool. Global package installations can execute arbitrary scripts during the installation process. - [EXTERNAL_DOWNLOADS]: The
sharedevCLI is used to pull documents, code components (PWC), and APL scripts from remote servers, introducing external content into the local development environment. - [CREDENTIALS_UNSAFE]: The skill processes sensitive information from a
settings.jsonfile, including acertificatefield (described as an API token), which is then used as a parameter for CLI commands. - [DYNAMIC_EXECUTION]: The skill uses
perlto perform automated in-place edits on existing markdown files belonging to other skills (sharedev-apl-implementandsharedev-apl-code-review). While intended for path correction, this mechanism allows for the dynamic modification of agent instructions.
Audit Metadata