generate-compile-commands
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- External Download and Execution: The skill downloads an executable tool (
msbuild-extractor-sample.exe) from a trusted GitHub repository associated with the skill's author. The download process includes a security best practice by performing a SHA256 integrity check to ensure the binary has not been tampered with before execution. - Data Ingestion Surface: The skill is designed to parse and process external project files, including
.sln,.slnx,.vcxproj, andmsbuild-extractor.json. These files represent an ingestion point for external data, which the agent uses to determine compilation parameters. - Ingestion points: Project and configuration files (SKILL.md).
- Boundary markers: The instructions provide specific patterns and tiered logic for parsing file content.
- Capability inventory: The skill utilizes shell execution for the extractor tool, CMake, and PowerShell scripts for JSON processing.
- Sanitization: Structured data processing is performed through PowerShell's
ConvertFrom-JsonandConvertTo-Jsonutilities to handle manual merging of compilation databases.
Audit Metadata