fit-ride-studio
Pass
Audited by Gen Agent Trust Hub on Aug 10, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses
npm cito install project dependencies defined in itspackage-lock.jsonfile. These downloads originate from the official NPM registry and are standard for the skill's operation. - [COMMAND_EXECUTION]: The skill executes local Node.js scripts (such as
analyze-fit.mjsandprepare-report.mjs) to process user-provided sports activity files (.fit, .kml). - [COMMAND_EXECUTION]: The skill initializes a local development server using Vite on
127.0.0.1:5174to host the visualization interface. The configuration includes robust protections against path traversal and ensures files are only served from a designated private temporary directory. - [COMMAND_EXECUTION]: The skill provides instructions to the agent to verify the integrity of the local server before use to prevent port-squatting or interaction with unrelated local services.
Audit Metadata