maestro-cli
Pass
Audited by Gen Agent Trust Hub on Jun 20, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads the Maestro CLI binary (version 2.5.1) directly from the project's official GitHub repository (mobile-dev-inc/Maestro) during the installation process.
- [COMMAND_EXECUTION]: The documentation in
SKILL.mdsuggests a common but risky installation pattern (curl -fsSL ... | bash). However, the skill's actual internalinstall.shuses a more controlled approach by downloading a specific versioned archive and verifying the environment within a sandbox. - [SAFE]: The installation script updates the container's package manager to use the Tsinghua University mirror (tuna.tsinghua.edu.cn), which is a reputable and standard practice for optimizing download speeds in certain network regions.
- [SAFE]: The execution environment mounts the host's home directory (
$HOME) to the container. This is a functional requirement to allow the Maestro CLI to access local mobile project files and YAML test flows located on the user's machine.
Audit Metadata