looker-dev
Pass
Audited by Gen Agent Trust Hub on Apr 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill scripts use
child_process.spawnto executenpxcommands, which is the intended mechanism to invoke the Looker developer tools with the required parameters. - [EXTERNAL_DOWNLOADS]: The skill fetches the
@toolbox-sdk/server@1.1.0package from the npm registry usingnpxat runtime. The use of a specific version tag is a security best practice that ensures only the intended version of the library is executed. - [SAFE]: The skill securely loads environment variables from a
.envfile located in the project's parent directory structure. This avoids hardcoding sensitive credentials and follows standard secret management practices for developer tools.
Audit Metadata