local-development

Pass

Audited by Gen Agent Trust Hub on Sep 27, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes standard development commands such as git clone, pnpm install, and pnpm dev to manage and run the site's code locally. These operations are performed within the local environment to facilitate site development.
  • [CREDENTIALS_SAFE]: The skill provides explicit instructions for secure API key handling, recommending the use of environment variables (REPLO_API_KEY) and git credential helpers instead of hardcoding secrets, printing them to logs, or passing them via command-line arguments.
  • [EXTERNAL_DOWNLOADS]: The skill fetches site code from the vendor's dedicated git server (git.replo.app). These references target the vendor's own infrastructure and are used for legitimate project synchronization.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external git repositories and runs project initialization commands like pnpm install. While this represents a potential surface for instructions embedded in repository files, the skill is intended for use with the user's own Replo sites, and the documentation emphasizes manual review before pushing or publishing.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 27, 2026, 07:24 AM