ci

Pass

Audited by Gen Agent Trust Hub on Aug 13, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes standard development tools including pnpm (lint, build, typecheck, exec), cargo (test), and electron-builder to simulate a CI environment locally. These actions are aligned with the skill's stated purpose of running 'local CI smoke tests'.
  • [EXTERNAL_DOWNLOADS]: The script contains instructions (printed via echo) for the user to manually download the Spout2 SDK from a third-party GitHub repository (github.com/leadedge/Spout2.git) if the vendor folder is missing. The skill does not automate this download or execute remote code from it.
  • [COMMAND_EXECUTION]: The skill uses $ARGUMENTS in a shell command within SKILL.md. While unquoted shell expansion of user input can sometimes lead to command injection, the bundled script uses a robust case statement and set -euo pipefail to safely parse specific allowed flags (--skip-common, --skip-native, --skip-package).
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 13, 2026, 04:27 AM
Security Audit — agent-trust-hub — ci