sf-onboard
Pass
Audited by Gen Agent Trust Hub on Jun 25, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches the project's core framework and starter templates from the author's GitHub repository (github:huangrx6/SpecForge). This is a documented part of the initialization process.
- [REMOTE_CODE_EXECUTION]: The skill utilizes
npxto execute the SpecForge CLI directly from the GitHub repository for environment initialization and runtime upgrades. It also references theskillsCLI for installing agent-specific skills from the same source. - [COMMAND_EXECUTION]: The skill executes local Node.js scripts such as
doctor.mjsfor environment diagnostics andcodebase-index.mjsfor cataloging repository metadata. These scripts are part of the framework's internal utility suite.
Audit Metadata