skills/time-attack/gstack/make-pdf/Gen Agent Trust Hub

make-pdf

Pass

Audited by Gen Agent Trust Hub on Aug 10, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The runtime-bootstrap.mjs script downloads manifest metadata and runtime components from the official time-attack GitHub repository. These downloads are restricted to known release hosts and are used to provide optional local rendering capabilities.
  • [REMOTE_CODE_EXECUTION]: The skill facilitates the installation of a local runtime environment. This involves downloading, verifying, and executing an installer script. The execution is gated by mandatory user consent (the --yes flag) and rigorous integrity checks.
  • [COMMAND_EXECUTION]: The skill utilizes Node.js and shell commands to manage its document processing and installation workflows. Commands are scoped to the user's home directory and the skill's specific operational requirements.
  • [DATA_EXFILTRATION]: A diagnostic tool, browser-provider-smoke.mjs, initiates a temporary local listener on 127.0.0.1 for browser readiness testing. It employs per-session random tokens and restrictive security headers to ensure the process remains isolated to the local machine and protected from external interference.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 10, 2026, 04:18 PM
Security Audit — agent-trust-hub — make-pdf