build-codemodekit-server

Pass

Audited by Gen Agent Trust Hub on Aug 16, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill guides the user through running shell commands to scaffold new projects using npm create, manage development lifecycles via npm start and npm run verify, and install IDE-specific plugins as documented in references/generator.md.
  • [EXTERNAL_DOWNLOADS]: The project generator downloads the codemodekit package from the npm registry. Examples in references/server-api.md also include downloading and running Docker containers from well-known registries such as the GitHub Container Registry.
  • [REMOTE_CODE_EXECUTION]: Documentation in references/generator.md provides examples for wrapping and executing remote tools using uvx, which downloads and runs packages from external repositories.
  • [COMMAND_EXECUTION]: The skill implements a run_typescript capability that executes code within a QuickJS sandbox. Additionally, the verification workflow in references/verification.md allows executing local code files defined in environment variables.
  • [PROMPT_INJECTION]: The skill processes untrusted project data and integrates with external APIs, presenting an indirect injection surface.
  • Ingestion points: The skill ingests repository files, package configurations, and outputs from integrated MCP servers in SKILL.md and references/verification.md.
  • Boundary markers: The architecture utilizes a QuickJS sandbox to isolate model-authored code and recommends explicit tool authorization policies in references/policy-and-security.md.
  • Capability inventory: The environment supports shell command execution, network operations, and filesystem interactions across various scripts.
  • Sanitization: The skill promotes the use of JSON Schema for input validation and provides a safe ToolError mechanism to prevent leaking sensitive host information.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 16, 2026, 11:02 AM
Security Audit — agent-trust-hub — build-codemodekit-server