blacksmith-testbox
Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill provides numerous shell orchestration blocks that use the
blacksmithCLI to provision, synchronize, and monitor remote build environments. - [REMOTE_CODE_EXECUTION]: The primary purpose of the skill is to execute build-system commands (Cargo, Zig) on remote Linux virtual machines provided by Blacksmith. The instructions include significant safeguards such as tree-SHA verification and clean-status checks to ensure only intended code is executed.
- [EXTERNAL_DOWNLOADS]: The skill fetches the current head of the vendor's repository (
https://github.com/manaflow-ai/cmux.git) to verify the state of the 'broker' branch and ensure cache warmth consistency. - [DATA_EXPOSURE]: The workflow involves handling a Blacksmith authentication token (
/tmp/.testbox/auth_token) used by the remote VM. The skill includes explicit warnings and instructions to prevent this token from being printed to logs or downloaded locally.
Audit Metadata