afk-turbo

Pass

Audited by Gen Agent Trust Hub on Jul 17, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The scripts/create-goal-launch.mjs script uses execFileSync to determine the git workspace root (git rev-parse --show-toplevel) and to open the generated HTML file using platform-specific commands (open, start, or xdg-open). These are legitimate functional uses within a development tool skill.
  • [EXTERNAL_DOWNLOADS]: The skill uses deep links to local protocols (codex://, claude-cli://) to facilitate task transition between different AI agent environments. These references are local to the user's machine and do not involve remote code downloads.
  • [REMOTE_CODE_EXECUTION]: The script starts a temporary local HTTP server (127.0.0.1) to provide a 'launch gate' interface. This server only handles local requests to facilitate a button-click response from the user and does not expose the system to remote execution risks.
  • [DATA_EXFILTRATION]: No network operations to external domains were found. The local server and deep links are used purely for local coordination and workflow continuity.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 17, 2026, 10:47 AM
Security Audit — agent-trust-hub — afk-turbo