maestro
Pass
Audited by Gen Agent Trust Hub on Nov 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructions include commands to download the Maestro CLI from its official GitHub release page (
https://github.com/mobile-dev-inc/maestro/releases). This is a trusted source for this specific tool. - [COMMAND_EXECUTION]: The skill demonstrates installation via a verified ZIP download rather than a shell script. It explicitly uses
sha256sum -c -to verify the integrity of the downloaded file against a published checksum before extraction and execution, which is a strong security best practice. - [COMMAND_EXECUTION]: The automated scanner flagged a 'remote code piped to sh' pattern. Upon manual review, this is a false positive: the command
curl -fsSL .../checksums_sha256.txt | sha256sum -c -pipes a text file into a checksum verification utility, not into a shell or interpreter.
Audit Metadata