console-anywhere

Pass

Audited by Gen Agent Trust Hub on Oct 22, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The doctor module in targets.py uses subprocess.run to check for the presence and version of local development tools like cmake, git, ninja, and java. These calls use structured list arguments to prevent command injection and are restricted to standard version-check flags (e.g., --version).
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests file names and scans binary headers (magic numbers) during the guard and package operations. This data is used defensively to identify and exclude copyrighted PlayStation 2 game assets (ISOs, MIPS ELFs) from user-created packages, representing a security guardrail rather than an exploitable vulnerability.
  • [SAFE]: The skill does not perform any network operations, use obfuscation, or implement persistence mechanisms. It operates entirely as a local file system and environment utility for porting software.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 22, 2026, 09:36 PM