xstate
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: Technical review of scripts/sync-docs.sh shows that the automated alert for remote code execution is a false positive. The script uses a minimal local Python command to parse JSON metadata from the GitHub API. This is a standard and safe developer practice for fetching version information from official repositories.
- [EXTERNAL_DOWNLOADS]: The skill manages its own documentation freshness by downloading content from the official statelyai/docs repository and the xstate npm package. These downloads are performed via curl and npm pack commands within an administrative script. The targets are well-known, official sources for the project, and no untrusted third-party servers are involved.
- [COMMAND_EXECUTION]: The skill includes shell and Python scripts for data processing and synchronization. These scripts are deterministic and limited to local file management and interactions with trusted developer platforms. No arbitrary command execution capabilities, privilege escalation vectors, or data exfiltration attempts were detected.
Audit Metadata