skills/nimblebraininc/mpak/verify-cli/Gen Agent Trust Hub

verify-cli

Pass

Audited by Gen Agent Trust Hub on Jun 22, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes shell commands to build and test the CLI. Specifically, it uses pnpm to build the SDK and CLI and then runs the built CLI using node dist/index.js. These are standard development tasks within a local monorepo environment (apps/mpak).
  • [DATA_EXPOSURE]: The skill interacts with the local configuration at ~/.mpak/config.json via config set, get, list, and clear commands. This is used for smoke testing the configuration management logic and does not involve accessing sensitive system credentials (e.g., SSH, AWS).
  • [REMOTE_CODE_EXECUTION]: The skill uses bundle pull and skill pull to download test packages to /tmp/. While these involve network operations to a production registry, the resources used (@nimblebraininc/echo, @nimblebraininc/skill-author) are provided by the vendor, and the downloads are not executed by the skill.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 22, 2026, 04:43 PM
Security Audit — agent-trust-hub — verify-cli