lint-and-validate
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The
scripts/lint_runner.pyscript executes project-defined linting commands usingsubprocess.run. - Evidence: It identifies commands such as
npm run lint,eslint, andtscfrom the project'spackage.jsonor localnode_modulesand executes them. - Safety Context: The implementation uses absolute paths to local
node_modules/.binfor Node.js tools and restricts Python execution to pre-installed tools likeruffandmypy. It explicitly warns the user inSKILL.mdthat project scripts should be inspected before use, as they can run arbitrary project code, which is a standard risk when working with external repositories.
Audit Metadata