cofounder-pre-flight-check
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill performs environment setup and validation tasks consistent with its stated purpose as a 'pre-flight check' for a development environment.
- [COMMAND_EXECUTION]: Executes a local bash script
scripts/preflight.shto perform checks. The script uses standard system commands (pwd,git status,command -v) to check for the presence of tools and verify git repository states. - [EXTERNAL_DOWNLOADS]: Fetches version information from the official GitHub API (
api.github.com/repos/locaweb/cofounder/contents/.claude-plugin/plugin.json). This is a well-known service and the domain belongs to the official GitHub platform, used here for integrity checking of the skill's own version. - [DATA_EXFILTRATION]: Contains a 'Sensitive file guard' in
scripts/preflight.shthat explicitly prevents sensitive files (like.env,id_rsa,.pem,credentials.json) from being tracked or committed to git. This is a security-positive feature designed to prevent credential exposure. - [REMOTE_CODE_EXECUTION]: While it suggests an update command involving
npx, this is presented as a user-instructed manual remediation step for version mismatches and is pointed at the vendor's own official package name on a standard registry.
Audit Metadata