make-env-setup

Pass

Audited by Gen Agent Trust Hub on Sep 24, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill downloads and installs software from external sources associated with the tool's vendor.
  • Installs the @qfeius/makecli package globally via npm.
  • Downloads and adds skills from the qfeius/make-platform-skills repository using npx.
  • References official installers for standard tools like Node.js and Git.
  • [COMMAND_EXECUTION]: The skill executes multiple system commands to configure and verify the local development environment.
  • Runs node -e scripts to verify the active Node.js and Corepack versions.
  • Executes corepack to enable and install specific pnpm versions.
  • Uses makecli for authentication (login) and project initialization.
  • Instructs the agent to update the user's shell profile to include new binary paths in the PATH environment variable.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided text that influences command-line arguments.
  • Ingestion points: User descriptions of their application are used to derive folder name recommendations in SKILL.md.
  • Boundary markers: No explicit boundary markers are defined for the interpolation of user-provided descriptions into the folder naming logic.
  • Capability inventory: The skill can perform file system operations (makecli app init), network requests (during tool installation and login), and environment modifications.
  • Sanitization: The skill relies on makecli to validate the resulting folder keys and includes a mandatory human-in-the-loop confirmation step before directory initialization.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 24, 2026, 07:30 AM