make-env-setup

Pass

Audited by Gen Agent Trust Hub on Sep 8, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Fetches the makecli tool from the author's Homebrew tap (qfeius/makecli) and installs Make platform skills using npx. These resources are hosted under the author's GitHub organization and represent standard environment configuration for this toolchain.- [REMOTE_CODE_EXECUTION]: Executes code during the installation of platform skills via npx skills add qfeius/make-platform-skills --all -y. This is standard behavior for extending the environment with vendor-provided capabilities.- [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided application descriptions to suggest project folder names. Ingestion points: User app descriptions are ingested in the 'Initialize App Project Folder' section. Boundary markers: No explicit delimiters or boundary markers are used when interpolating user-derived strings into the initialization command. Capability inventory: The skill possesses file writing and command execution capabilities via makecli app init and npx. Sanitization: Validation of the folder name is delegated to the makecli tool itself, which checks for compliant naming rules.- [COMMAND_EXECUTION]: Performs several system checks and configuration tasks using shell commands, including OS identification (uname), dependency checks (node, pnpm, git), and toolchain management.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 8, 2026, 02:05 AM
Security Audit — agent-trust-hub — make-env-setup