local-development
Pass
Audited by Gen Agent Trust Hub on Sep 27, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes standard development commands such as
git clone,pnpm install, andpnpm devto manage and run the site's code locally. These operations are performed within the local environment to facilitate site development. - [CREDENTIALS_SAFE]: The skill provides explicit instructions for secure API key handling, recommending the use of environment variables (
REPLO_API_KEY) and git credential helpers instead of hardcoding secrets, printing them to logs, or passing them via command-line arguments. - [EXTERNAL_DOWNLOADS]: The skill fetches site code from the vendor's dedicated git server (
git.replo.app). These references target the vendor's own infrastructure and are used for legitimate project synchronization. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external git repositories and runs project initialization commands like
pnpm install. While this represents a potential surface for instructions embedded in repository files, the skill is intended for use with the user's own Replo sites, and the documentation emphasizes manual review before pushing or publishing.
Audit Metadata