umbraco-reference-instance

Pass

Audited by Gen Agent Trust Hub on Sep 22, 2026

Risk Level: SAFEDYNAMIC_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
  • [DYNAMIC_EXECUTION]: The instance.sh try script dynamically generates a temporary .NET project by copying C# source files from other skills and performing string substitutions (e.g., replacing <Namespace> placeholders) before building and executing the code. This mechanism is central to the skill's purpose of verifying that generated code compiles and functions correctly.- [COMMAND_EXECUTION]: The skill utilizes shell commands to manage the lifecycle of a local Umbraco instance, including building projects with dotnet build, running the resulting application via the dotnet runtime, and executing vendor tools using npx.- [EXTERNAL_DOWNLOADS]: The skill fetches official vendor tools and libraries, such as the @umbraco-cms/mcp-dev utility via npx and the Umbraco.Cms.Web.Website package via the .NET NuGet registry.- [DATA_EXFILTRATION]: Instructions and scripts within the skill include settings to bypass TLS certificate validation, specifically through NODE_TLS_REJECT_UNAUTHORIZED=0 and curl -sk. The provided instance.sh script enforces a check that restricts this insecure behavior to localhost and 127.0.0.1, which is a standard approach for handling self-signed development certificates during local testing.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 22, 2026, 12:04 PM