cli-just

Pass

Audited by Gen Agent Trust Hub on Oct 7, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill facilitates the creation and execution of task recipes using the just command runner. The workflow emphasizes inspecting version capabilities and existing repository conventions before making changes, and requires validation of recipes through just --list or just --summary commands.\n- [DYNAMIC_EXECUTION]: The skill supports the generation and execution of inline scripts (e.g., bash, node) within justfiles. Reference documentation provides guidance on interpreter selection and shebang usage, which are standard features for the intended task-runner functionality.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes project-specific data which serves as a potential attack surface.\n
  • Ingestion points: Reads existing justfiles, repository file structures, and tool outputs like just --list and just --dump.\n
  • Boundary markers: No specific delimiters or safety warnings for external content are defined in the instructions.\n
  • Capability inventory: Inherently allows execution of shell commands and filesystem operations through generated recipes.\n
  • Sanitization: Requires dry-runs, expanded command inspection, and parser validation to ensure recipe safety and correctness.\n- [EXTERNAL_DOWNLOADS]: The skill references external dependencies and configuration modules, such as @sablier/devkit and tools like ni or bun. These are standard developer ecosystem packages or vendor-owned resources (Sablier Labs/paulrberg) used for legitimate repository maintenance tasks.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 7, 2026, 10:18 PM