looker-dev

Pass

Audited by Gen Agent Trust Hub on Apr 29, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill scripts use child_process.spawn to execute npx commands, which is the intended mechanism to invoke the Looker developer tools with the required parameters.
  • [EXTERNAL_DOWNLOADS]: The skill fetches the @toolbox-sdk/server@1.1.0 package from the npm registry using npx at runtime. The use of a specific version tag is a security best practice that ensures only the intended version of the library is executed.
  • [SAFE]: The skill securely loads environment variables from a .env file located in the project's parent directory structure. This avoids hardcoding sensitive credentials and follows standard secret management practices for developer tools.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 29, 2026, 05:18 AM