stream-builder
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches configuration, UI components, and optional skill packs from trusted and well-known organizations including Vercel Labs, Anthropic, and Shadcn. These operations are conducted using standard package runners (npx) and follow the Trust Scope Rule.
- [COMMAND_EXECUTION]: The builder utilizes the vendor-provided
getstreamCLI and standard Node.js package managers (npm,npx) to perform project initialization, SDK installation, and environment configuration. These actions are aligned with the skill's primary purpose. - [DYNAMIC_EXECUTION]: Employs short, inline Node.js scripts for deterministic local configuration tasks, such as programmatically slugifying the project name in
package.jsonand verifying the availability of icon libraries in the current workspace. - [CREDENTIALS_SAFE]: Instructions include clear security protocols regarding environment variables. The skill explicitly forbids the agent from reading or transmitting secrets from
.envfiles and relies on the localgetstreamCLI to manage credentials securely.
Audit Metadata