builder-smoke-test
Warn
Audited by Gen Agent Trust Hub on May 20, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill executes multiple local shell scripts (scaffold.sh, preflight.sh, wait-for-server.sh, seed-multi-user.sh) and system commands (pnpm, kill, lsof, sqlite3) to manage the testing environment and lifecycle. It also instructs the agent to source user shell configuration files (e.g., ~/.zshrc, ~/.bashrc) to retrieve missing environment variables.\n- [EXTERNAL_DOWNLOADS]: The scaffold.sh script triggers pnpm install, which retrieves multiple dependencies from the npm registry to build the temporary test project.\n- [CREDENTIALS_UNSAFE]: The skill processes sensitive credentials such as OPENAI_API_KEY and WORKOS_API_KEY, writing them to local .env files. Additionally, it implements a 'cookie leak' debug route in the test project to allow extraction of session cookies for authenticated API requests.
Audit Metadata