Skills
skills/openharmonyinsight/openharmony-skills/ohos-dev-distributed-cpp-callgraph-analysis/Gen Agent Trust Hub

ohos-dev-distributed-cpp-callgraph-analysis

Fail

Audited by Gen Agent Trust Hub on Jun 26, 2026

Risk Level: HIGHEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: scripts/setup_lsp.py fetches the Go programming language toolchain from the official go.dev domain during its setup process.
  • [EXTERNAL_DOWNLOADS]: scripts/setup_lsp.py installs the mcp-language-server utility from a third-party GitHub repository (isaacphi/mcp-language-server) to bridge LLVM analysis tools with the agent.
  • [COMMAND_EXECUTION]: The skill executes numerous system tools as part of its analysis workflow, including the OpenHarmony build script (build.sh) and LLVM utilities such as opt, llvm-dis, and llvm-cxxfilt.
  • [COMMAND_EXECUTION]: scripts/setup_lsp.py automates the configuration of agent clients by executing shell commands to register the MCP service and modifying local configuration files like .claude/settings.local.json.
  • [REMOTE_CODE_EXECUTION]: The bootstrap process downloads, builds, and executes an external Go-based binary to provide the Language Server Protocol (LSP) interface required for symbol resolution.
  • [COMMAND_EXECUTION]: The setup script generates a Python helper script (ensure_compdb.py) from an internal template and configures it as a functional hook for the agent to dynamically update compilation databases.
Recommendations
  • HIGH: Downloads and executes remote code from: unknown (check file) - DO NOT USE without thorough review
Audit Metadata
Risk Level
HIGH
Analyzed
Jun 26, 2026, 01:43 PM
Security Audit — agent-trust-hub — ohos-dev-distributed-cpp-callgraph-analysis