m5-onboard
Pass
Audited by Gen Agent Trust Hub on Nov 3, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONPRIVILEGE_ESCALATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches the Homebrew installation script from its official GitHub repository and downloads firmware binaries from the M5Burner manifest API. It also clones the skill's supporting logic from a public GitHub repository.
- [REMOTE_CODE_EXECUTION]: Instructs the agent to execute the Homebrew installation script via a shell pipe (curl | bash). This is a well-known and standard setup procedure for macOS development environments and originates from a trusted service.
- [COMMAND_EXECUTION]: Utilizes system package managers such as winget, apt, dnf, pacman, and brew to install Python and its dependencies. The skill also executes local Python scripts to interact with hardware via serial ports and manage device provisioning.
- [PRIVILEGE_ESCALATION]: Recommends using sudo for system package installation and for modifying user group memberships (dialout/uucp) on Linux systems to grant necessary permissions for serial port access.
Audit Metadata