hmos-arkts-syntax-checker
Pass
Audited by Gen Agent Trust Hub on Jun 22, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes specialized tools such as
mcp_codegenie-mcp_build_projectand standard file system utilities likeWriteandSearchReplaceto perform project compilation and automated code fixes. - [EXTERNAL_DOWNLOADS]: Documentation within the skill guides users to install necessary dependencies from the official NPM registry using
npx. These instructions point to legitimate-looking resources such as@deveco-codegenie/mcpanddeveco-mcp-serverfor environment setup. - [PROMPT_INJECTION]: The skill processes external project files including
.etssource code and.json5configurations. While this creates a potential surface for indirect prompt injection where malicious instructions could be embedded in user code, the skill itself does not contain malicious triggers and operates within the context of developer tooling. - [DATA_EXPOSURE]: The skill accesses project-level configuration files (
build-profile.json5,oh-package.json5) to analyze build settings. This is standard behavior for a build automation tool and does not involve exfiltration of sensitive user credentials or environment variables.
Audit Metadata