dev-proxy-init

Pass

Audited by Gen Agent Trust Hub on Apr 13, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: Executes shell commands to verify environment prerequisites and tool installation status.
  • [COMMAND_EXECUTION]: Requests administrative privileges via sudo to configure local DNS resolution and manage system services for proxying. These commands require explicit user confirmation.
  • [EXTERNAL_DOWNLOADS]: Downloads and installs the @reopt-ai/dev-proxy package from the npm registry.
  • [PROMPT_INJECTION]: Analyzes various project configuration files to detect frameworks and service ports, creating a surface for indirect prompt injection.
  • Ingestion points: Reads contents of package.json, framework configs (Next.js, Vite, etc.), and monorepo files (turbo.json, nx.json) during project detection.
  • Boundary markers: Does not implement explicit delimiters or warnings to ignore instructions embedded in the analyzed files.
  • Capability inventory: Executes shell commands, writes configuration files, and performs sudo-level system changes.
  • Sanitization: Does not explicitly describe validation or escaping of data extracted from project files before processing.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 13, 2026, 09:14 AM
Security Audit — agent-trust-hub — dev-proxy-init