objectstack-platform

Pass

Audited by Gen Agent Trust Hub on Jun 15, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill references numerous packages under the @objectstack/ scope (e.g., @objectstack/core, @objectstack/spec, @objectstack/runtime). These are vendor-owned resources originating from the author 'objectstack-ai'.
  • [REMOTE_CODE_EXECUTION]: Provides instructions for bootstrapping new projects using npx create-objectstack. This is a standard and expected method for project initialization using the vendor's official CLI tool from the public npm registry.
  • [COMMAND_EXECUTION]: Documents various CLI commands (os dev, os start, os build, os compile) used for local development, building artifacts, and running the runtime server. These commands are essential to the framework's intended operation.
  • [CREDENTIALS_UNSAFE]: References sensitive keys such as TURSO_AUTH_TOKEN, DATABASE_URL, and AUTH_SECRET. The skill correctly advises users to manage these via environment variables and .env files rather than hardcoding them, aligning with security best practices. It also mentions default development-only credentials (admin123) used specifically for the os dev --fresh ephemeral mode.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 15, 2026, 01:00 PM
Security Audit — agent-trust-hub — objectstack-platform