cli-just
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill facilitates the creation and execution of task recipes using the
justcommand runner. The workflow emphasizes inspecting version capabilities and existing repository conventions before making changes, and requires validation of recipes throughjust --listorjust --summarycommands.\n- [DYNAMIC_EXECUTION]: The skill supports the generation and execution of inline scripts (e.g., bash, node) within justfiles. Reference documentation provides guidance on interpreter selection and shebang usage, which are standard features for the intended task-runner functionality.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes project-specific data which serves as a potential attack surface.\n - Ingestion points: Reads existing
justfiles, repository file structures, and tool outputs likejust --listandjust --dump.\n - Boundary markers: No specific delimiters or safety warnings for external content are defined in the instructions.\n
- Capability inventory: Inherently allows execution of shell commands and filesystem operations through generated recipes.\n
- Sanitization: Requires dry-runs, expanded command inspection, and parser validation to ensure recipe safety and correctness.\n- [EXTERNAL_DOWNLOADS]: The skill references external dependencies and configuration modules, such as
@sablier/devkitand tools likeniorbun. These are standard developer ecosystem packages or vendor-owned resources (Sablier Labs/paulrberg) used for legitimate repository maintenance tasks.
Audit Metadata