skills/posit-dev/positron/launch/Gen Agent Trust Hub

launch

Pass

Audited by Gen Agent Trust Hub on Jul 30, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes shell scripts (launch.sh, monaco-paste.sh) to manage the Electron lifecycle and UI automation. These scripts use standard system tools (rsync, curl, node, jq) to perform their tasks. The use of nohup and disown is appropriate for managing detached Electron processes in a development workflow.
  • [EXTERNAL_DOWNLOADS]: The launcher invokes node build/lib/preLaunch.ts within the VS Code repository, which is a standard step in VS Code development to ensure the Electron binary is present and the source is compiled. This targets official infrastructure.
  • [DATA_EXPOSURE]: The skill documentation correctly identifies that authentication tokens are stored in the OS keychain and User/globalStorage. The launcher handles these by cloning the necessary files to a temporary throwaway profile. This is a legitimate development workflow designed to allow testing authenticated features (like Copilot) without mutating the user's primary development environment.
  • [DYNAMIC_EXECUTION]: The scripts use node -e to perform small tasks like port selection and text-based JSON merging for settings. These operations are performed using static templates or safe string interpolation to ensure the environment remains consistent.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 30, 2026, 01:46 PM
Security Audit — agent-trust-hub — launch