make-app-runtime
Pass
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is a legitimate development tool for managing Make App project structures. It defines strict rules for workspace configuration (pnpm), Service entry points, and build outputs (
apps/ui/dist,apps/service/dist/server.js). - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted project data such as
package.jsonandpnpm-workspace.yaml. - Ingestion points: Processes workspace manifests in
apps/andapps/service/folders (SKILL.md). - Boundary markers: None explicitly defined for these files, although the skill enforces a specific structural contract.
- Capability inventory: Executes commands via
pnpm,node, andmakecli. Modifies project files and build configurations (SKILL.md). - Sanitization: The skill includes instructions to sanitize input by dropping standalone
--separators before parsing arguments in Node wrappers to prevent command injection (SKILL.md). - [COMMAND_EXECUTION]: The skill references the use of
makecli, a vendor-specific tool for deployment and diffing. These operations are consistent with the skill's stated purpose of managing Make App projects.
Audit Metadata