stream-builder

Pass

Audited by Gen Agent Trust Hub on Oct 23, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill fetches configuration, UI components, and optional skill packs from trusted and well-known organizations including Vercel Labs, Anthropic, and Shadcn. These operations are conducted using standard package runners (npx) and follow the Trust Scope Rule.
  • [COMMAND_EXECUTION]: The builder utilizes the vendor-provided getstream CLI and standard Node.js package managers (npm, npx) to perform project initialization, SDK installation, and environment configuration. These actions are aligned with the skill's primary purpose.
  • [DYNAMIC_EXECUTION]: Employs short, inline Node.js scripts for deterministic local configuration tasks, such as programmatically slugifying the project name in package.json and verifying the availability of icon libraries in the current workspace.
  • [CREDENTIALS_SAFE]: Instructions include clear security protocols regarding environment variables. The skill explicitly forbids the agent from reading or transmitting secrets from .env files and relies on the local getstream CLI to manage credentials securely.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 23, 2026, 08:32 AM