aspireify

Pass

Audited by Gen Agent Trust Hub on Jul 30, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • Remote Script Execution: The skill provides instructions to install the Aspire CLI using a script from https://aspire.dev/install.sh. This process involves executing remote code in the local shell. While this is the official installation method for the tool, it represents a pattern where external content is executed. The resource is located on the official project domain.
  • External Package Installation: The skill's documentation references the use of various packages for features like OpenTelemetry and framework hosting. These are standard libraries sourced from public registries like npm and NuGet. Using external packages requires trust in the registry and the package maintainers, which is typical for modern software development.
  • Processing of Repository Data: The skill scans a user's repository—including configuration files, project definitions, and environment variables—to automate the setup of the application's infrastructure. Ingesting untrusted data from a repository could theoretically allow malicious content to influence the agent's behavior. The skill mitigates this by requiring user confirmation for all proposed changes before they are implemented.
  • System Command Execution: The skill is designed to run various commands such as dotnet, npm, and aspire to manage projects and lifecycle operations. These commands interact directly with the system to perform their intended tasks. This is a core component of the skill's functionality and operates within the context of the user's development environment.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 30, 2026, 11:54 AM
Security Audit — agent-trust-hub — aspireify