oh-capi-xts-gen
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill includes several utility scripts (
scripts/async_build.sh,scripts/async_build_manager.py,scripts/verify_napi_triple.sh) that automate the OpenHarmony build and verification workflow. - These scripts invoke standard OpenHarmony build tools like
./test/xts/acts/build.shand perform routine file system operations (e.g., creating log directories in/tmp/oh_capi_build). - Input validation is implemented via regex (e.g., verifying that suite names contain only alphanumeric characters) to mitigate the risk of argument injection.
- [DYNAMIC_EXECUTION]: The core functionality of the skill is the dynamic generation of C++ N-API source code and ETS/ArkTS test files based on parsed header files. This behavior is the intended primary purpose of the skill for developers and is guided by structured templates in the
modules/L2_Generation/directory. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input in the form of C header files (.h) and coverage reports to drive code generation.
- Ingestion point:
modules/L1_Analysis/parser/unified_api_parser_c.mddescribes the parsing of external header files. - Boundary markers: The generated code utilizes standard OpenHarmony
@tcannotation blocks to structure metadata. - Capability inventory: The skill uses
BashandWritetools to execute build scripts and save generated source files. - Sanitization: The skill includes validation steps (Phase 5: N-API Triple Verification) to ensure generated interfaces are consistent and conform to specifications.
Audit Metadata