justfile-author
Pass
Audited by Gen Agent Trust Hub on Jul 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The
assets/Makefile.tmplfile contains a recipe to download thejusttask runner directly from its official domain athttps://just.systems/install.sh. This uses a standard installation pattern (curl piped to bash) for this well-known developer tool. - [COMMAND_EXECUTION]: The skill workflow includes instructions for the agent to grant execution permissions to generated scripts using
chmod +x. Additionally, the Makefile template includes commands to install software via system package managers likebrew,cargo, andsnap. - [PROMPT_INJECTION]: The skill logic involves reading command names and scripts from local project files (such as
package.jsonorpyproject.toml) and interpolating them into generated task runner files. While this creates a surface for indirect prompt injection if project files contain malicious content, the behavior is localized and consistent with the skill's purpose as a scaffolding tool.
Audit Metadata