affinity
Pass
Audited by Gen Agent Trust Hub on Oct 11, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill includes a Node.js CLI (
scripts/affinity-cli.mjs) that executes JavaScript scripts within the Affinity application's environment. This is the intended primary purpose of the skill. - [DATA_EXPOSURE]: The CLI communicates with a local automation endpoint hosted by the Affinity app at
http://localhost:6767/sse. It includes a security measure to verify that session-scoped URLs provided by the endpoint do not point to an external origin. - [EXTERNAL_DOWNLOADS]: Example scripts and tests demonstrate fetching data from external URLs (e.g.,
serif.com,jsonlint.com, andhttpbin.org) using the Affinity SDK's network API. This capability is subject to the application's internal security settings. - [DYNAMIC_EXECUTION]: The skill's core functionality is the dynamic execution of JavaScript code to control Affinity. The application's own security model requires explicit user permission for scripts to access the network or the local filesystem (limited to the Desktop).
Audit Metadata