ci
Pass
Audited by Gen Agent Trust Hub on Aug 13, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes standard development tools including
pnpm(lint, build, typecheck, exec),cargo(test), andelectron-builderto simulate a CI environment locally. These actions are aligned with the skill's stated purpose of running 'local CI smoke tests'. - [EXTERNAL_DOWNLOADS]: The script contains instructions (printed via echo) for the user to manually download the Spout2 SDK from a third-party GitHub repository (
github.com/leadedge/Spout2.git) if the vendor folder is missing. The skill does not automate this download or execute remote code from it. - [COMMAND_EXECUTION]: The skill uses
$ARGUMENTSin a shell command withinSKILL.md. While unquoted shell expansion of user input can sometimes lead to command injection, the bundled script uses a robustcasestatement andset -euo pipefailto safely parse specific allowed flags (--skip-common,--skip-native,--skip-package).
Audit Metadata