afk-turbo
Pass
Audited by Gen Agent Trust Hub on Jul 17, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The
scripts/create-goal-launch.mjsscript usesexecFileSyncto determine the git workspace root (git rev-parse --show-toplevel) and to open the generated HTML file using platform-specific commands (open,start, orxdg-open). These are legitimate functional uses within a development tool skill. - [EXTERNAL_DOWNLOADS]: The skill uses deep links to local protocols (
codex://,claude-cli://) to facilitate task transition between different AI agent environments. These references are local to the user's machine and do not involve remote code downloads. - [REMOTE_CODE_EXECUTION]: The script starts a temporary local HTTP server (
127.0.0.1) to provide a 'launch gate' interface. This server only handles local requests to facilitate a button-click response from the user and does not expose the system to remote execution risks. - [DATA_EXFILTRATION]: No network operations to external domains were found. The local server and deep links are used purely for local coordination and workflow continuity.
Audit Metadata