dev-bootstrap
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFECOMMAND_EXECUTIONPRIVILEGE_ESCALATIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The core logic in
scripts/preflight.mjsuseschild_process.spawnSyncto execute shell commands defined in profile configuration files. Specifically, therunFixfunction executes thefixCmdproperty from JSON profiles when the--fixflag is provided. - Evidence:
profiles/deepworks.jsoncontains several commands such aspnpm install,pnpm --filter @openwork/types build, andelectron-builder install-app-deps. - [PRIVILEGE_ESCALATION]: The skill identifies missing system-level components and suggests commands that require elevated privileges to execute.
- Evidence: The
vs-buildtoolscheck inprofiles/deepworks.jsonprovides afixCmdusingwinget installfor Microsoft Visual Studio Build Tools, which typically triggers a User Account Control (UAC) prompt on Windows. - [EXTERNAL_DOWNLOADS]: The skill automates the installation of dependencies and system tools from external sources.
- Evidence: Execution of
pnpm installfetches packages from the npm registry, and thevs-buildtoolscommand downloads several gigabytes of data from Microsoft's distribution servers.
Audit Metadata