make-env-setup
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads and installs software from external sources associated with the tool's vendor.
- Installs the
@qfeius/makeclipackage globally vianpm. - Downloads and adds skills from the
qfeius/make-platform-skillsrepository usingnpx. - References official installers for standard tools like Node.js and Git.
- [COMMAND_EXECUTION]: The skill executes multiple system commands to configure and verify the local development environment.
- Runs
node -escripts to verify the active Node.js and Corepack versions. - Executes
corepackto enable and install specificpnpmversions. - Uses
makeclifor authentication (login) and project initialization. - Instructs the agent to update the user's shell profile to include new binary paths in the
PATHenvironment variable. - [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided text that influences command-line arguments.
- Ingestion points: User descriptions of their application are used to derive folder name recommendations in
SKILL.md. - Boundary markers: No explicit boundary markers are defined for the interpolation of user-provided descriptions into the folder naming logic.
- Capability inventory: The skill can perform file system operations (
makecli app init), network requests (during tool installation and login), and environment modifications. - Sanitization: The skill relies on
makeclito validate the resulting folder keys and includes a mandatory human-in-the-loop confirmation step before directory initialization.
Audit Metadata