maestro-cli

Pass

Audited by Gen Agent Trust Hub on Jun 20, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill downloads the Maestro CLI binary (version 2.5.1) directly from the project's official GitHub repository (mobile-dev-inc/Maestro) during the installation process.
  • [COMMAND_EXECUTION]: The documentation in SKILL.md suggests a common but risky installation pattern (curl -fsSL ... | bash). However, the skill's actual internal install.sh uses a more controlled approach by downloading a specific versioned archive and verifying the environment within a sandbox.
  • [SAFE]: The installation script updates the container's package manager to use the Tsinghua University mirror (tuna.tsinghua.edu.cn), which is a reputable and standard practice for optimizing download speeds in certain network regions.
  • [SAFE]: The execution environment mounts the host's home directory ($HOME) to the container. This is a functional requirement to allow the Maestro CLI to access local mobile project files and YAML test flows located on the user's machine.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 20, 2026, 02:29 PM