oh-capi-xts-gen

Pass

Audited by Gen Agent Trust Hub on Sep 16, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill includes several utility scripts (scripts/async_build.sh, scripts/async_build_manager.py, scripts/verify_napi_triple.sh) that automate the OpenHarmony build and verification workflow.
  • These scripts invoke standard OpenHarmony build tools like ./test/xts/acts/build.sh and perform routine file system operations (e.g., creating log directories in /tmp/oh_capi_build).
  • Input validation is implemented via regex (e.g., verifying that suite names contain only alphanumeric characters) to mitigate the risk of argument injection.
  • [DYNAMIC_EXECUTION]: The core functionality of the skill is the dynamic generation of C++ N-API source code and ETS/ArkTS test files based on parsed header files. This behavior is the intended primary purpose of the skill for developers and is guided by structured templates in the modules/L2_Generation/ directory.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input in the form of C header files (.h) and coverage reports to drive code generation.
  • Ingestion point: modules/L1_Analysis/parser/unified_api_parser_c.md describes the parsing of external header files.
  • Boundary markers: The generated code utilizes standard OpenHarmony @tc annotation blocks to structure metadata.
  • Capability inventory: The skill uses Bash and Write tools to execute build scripts and save generated source files.
  • Sanitization: The skill includes validation steps (Phase 5: N-API Triple Verification) to ensure generated interfaces are consistent and conform to specifications.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 16, 2026, 02:24 AM