setup
Pass
Audited by Gen Agent Trust Hub on May 13, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches pre-compiled binary archives from the author's repository on GitHub (open-horizon-labs/repo-native-alignment). This is a well-known service and the resources belong to the vendor's infrastructure.
- [REMOTE_CODE_EXECUTION]: Downloads and extracts executable binaries into the user's PATH (~/.cargo/bin/). This behavior is standard for the described purpose of setting up a new command-line tool.
- [COMMAND_EXECUTION]: Executes shell commands to detect system architecture (uname, sysctl), manage files (mkdir, tar), and configure the MCP server (claude mcp add). It also runs the tool's own indexing command (repo-native-alignment scan).
- [DATA_EXPOSURE]: The skill analyzes local repository framework patterns (Step 5b) using shell pipes. While this processes repository data, the logic (grep/sort/comm) is used for configuration diagnostics and does not involve exfiltration to external domains.
Audit Metadata