skills/jablonkai/skills/affinity/Gen Agent Trust Hub

affinity

Pass

Audited by Gen Agent Trust Hub on Oct 11, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill includes a Node.js CLI (scripts/affinity-cli.mjs) that executes JavaScript scripts within the Affinity application's environment. This is the intended primary purpose of the skill.
  • [DATA_EXPOSURE]: The CLI communicates with a local automation endpoint hosted by the Affinity app at http://localhost:6767/sse. It includes a security measure to verify that session-scoped URLs provided by the endpoint do not point to an external origin.
  • [EXTERNAL_DOWNLOADS]: Example scripts and tests demonstrate fetching data from external URLs (e.g., serif.com, jsonlint.com, and httpbin.org) using the Affinity SDK's network API. This capability is subject to the application's internal security settings.
  • [DYNAMIC_EXECUTION]: The skill's core functionality is the dynamic execution of JavaScript code to control Affinity. The application's own security model requires explicit user permission for scripts to access the network or the local filesystem (limited to the Desktop).
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 11, 2026, 10:48 AM