docs-site-macos
Warn
Audited by Gen Agent Trust Hub on Jun 12, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill contains instructions for the agent to execute shell commands to manage the local environment. Specifically, the 'Auto-Host' section uses
lsofandkill -9to terminate any existing process on port 8765. - [EXTERNAL_DOWNLOADS]: The skill utilizes
npx serveto host the generated site for preview.npxmay download theservepackage from the npm registry if it is not already available in the local cache. Additionally, the skill links to external font resources from Google Fonts (fonts.googleapis.com). - [REMOTE_CODE_EXECUTION]: The 'Auto-Host' functionality spawns a background service using
nohup npx serve ... &. This pattern executes an external Node.js package, which constitutes remote code execution when the package is fetched at runtime. - [DATA_EXPOSURE]: The skill operates on the local file system, specifically creating and modifying files within the
llmwiki/directory. While this is consistent with its stated purpose of building a documentation wiki, it involves broad write access to project subdirectories.
Audit Metadata