make-env-setup
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches the makecli tool from the author's Homebrew tap (qfeius/makecli) and installs Make platform skills using npx. These resources are hosted under the author's GitHub organization and represent standard environment configuration for this toolchain.- [REMOTE_CODE_EXECUTION]: Executes code during the installation of platform skills via npx skills add qfeius/make-platform-skills --all -y. This is standard behavior for extending the environment with vendor-provided capabilities.- [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided application descriptions to suggest project folder names. Ingestion points: User app descriptions are ingested in the 'Initialize App Project Folder' section. Boundary markers: No explicit delimiters or boundary markers are used when interpolating user-derived strings into the initialization command. Capability inventory: The skill possesses file writing and command execution capabilities via makecli app init and npx. Sanitization: Validation of the folder name is delegated to the makecli tool itself, which checks for compliant naming rules.- [COMMAND_EXECUTION]: Performs several system checks and configuration tasks using shell commands, including OS identification (uname), dependency checks (node, pnpm, git), and toolchain management.
Audit Metadata