agent-dev-workflow
Pass
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill provides Bash scripts in the
references/bin/directory that automate environment setup and process management. These scripts use standard system utilities such asdocker,git, andps. For example,references/bin/_common.shusesdocker runanddocker execto manage the lifecycle of a shared Postgres container, whileapp_dev_stoputilizeskillwith process group IDs (-$pid) to supervise stack teardown. The use ofevalinbin/dev-fullstackis constrained to specific, internally defined environment variable keys for tracking session state. - [EXTERNAL_DOWNLOADS]: The
bin/setupscript facilitates environment onboarding by runningbun installfor Node.js dependencies andasdf installfor tool versioning. It also supports fetching database snapshots from Google Cloud Storage usinggcloud storage cat. These actions target reputable registries and official tools as part of the intended developer workflow. - [CREDENTIALS_UNSAFE]: Hardcoded development credentials (
APP_PG_USER="app",APP_PG_PASSWORD="app") are present inreferences/bin/_common.sh. These are standard defaults for isolated local development containers and are common in scaffolding templates.
Audit Metadata