skills/shyxin/skills/dev-bootstrap/Gen Agent Trust Hub

dev-bootstrap

Pass

Audited by Gen Agent Trust Hub on Sep 21, 2026

Risk Level: SAFECOMMAND_EXECUTIONPRIVILEGE_ESCALATIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The core logic in scripts/preflight.mjs uses child_process.spawnSync to execute shell commands defined in profile configuration files. Specifically, the runFix function executes the fixCmd property from JSON profiles when the --fix flag is provided.
  • Evidence: profiles/deepworks.json contains several commands such as pnpm install, pnpm --filter @openwork/types build, and electron-builder install-app-deps.
  • [PRIVILEGE_ESCALATION]: The skill identifies missing system-level components and suggests commands that require elevated privileges to execute.
  • Evidence: The vs-buildtools check in profiles/deepworks.json provides a fixCmd using winget install for Microsoft Visual Studio Build Tools, which typically triggers a User Account Control (UAC) prompt on Windows.
  • [EXTERNAL_DOWNLOADS]: The skill automates the installation of dependencies and system tools from external sources.
  • Evidence: Execution of pnpm install fetches packages from the npm registry, and the vs-buildtools command downloads several gigabytes of data from Microsoft's distribution servers.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 21, 2026, 01:15 AM