oh-xts-generator-template
Warn
Audited by Gen Agent Trust Hub on Mar 24, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The script
modules/L4_Build/cleanup_group.shparsesBUILD.gnfiles to extract dependency paths and subsequently executesrm -rfon those directories. This pattern of parsing untrusted project configuration to perform recursive deletions poses a risk of unintended file loss if the configuration files are maliciously crafted. - [EXTERNAL_DOWNLOADS]: The build workflow in
modules/L4_Build/linux_compile_static_suite.mdincludes commands to clone external compilation tools fromgitee.com/laoji-fuli/hvigor0702.git. Gitee is a third-party repository host that is not part of the trusted vendor or well-known service lists provided in the core configuration. - [REMOTE_CODE_EXECUTION]: The environment setup guide in
modules/L4_Build/linux_compile_env_setup.mdinstructs the user to install Node.js usingcurl -fsSL https://deb.nodesource.com/setup_16.x | sudo -E bash -. While Nodesource is a well-known service for Node.js distributions, piping remote scripts directly into a root shell is a high-risk pattern. - [COMMAND_EXECUTION]: The 'Automatic Error Repair' mechanism described in
modules/L4_Build/linux_compile_troubleshooting.mdpermits the agent to autonomously analyze compiler logs, generate 'fix' code, and rewrite existing source files at runtime. This self-modifying code behavior increases the skill's autonomy and potential for unintended modifications to the user's workspace. - [COMMAND_EXECUTION]: The skill includes installation scripts (
references/arkts-static-spec/README.md) that copy files to the persistent AI skill directory (~/.claude/skills/), which establishes local persistence for the skill's components. - [PROMPT_INJECTION]: The skill contains highly rigid instructions in
references/arkts-static-spec/README.mdandSKILL.mdthat command the AI to 'strictly' follow provided docs and 'ignore' features outside the specified ArkTS scope. While intended for template consistency, these act as behavioral overrides for the agent's default reasoning capabilities.
Audit Metadata