umbraco-reference-instance
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- [DYNAMIC_EXECUTION]: The
instance.sh tryscript dynamically generates a temporary .NET project by copying C# source files from other skills and performing string substitutions (e.g., replacing<Namespace>placeholders) before building and executing the code. This mechanism is central to the skill's purpose of verifying that generated code compiles and functions correctly.- [COMMAND_EXECUTION]: The skill utilizes shell commands to manage the lifecycle of a local Umbraco instance, including building projects withdotnet build, running the resulting application via thedotnetruntime, and executing vendor tools usingnpx.- [EXTERNAL_DOWNLOADS]: The skill fetches official vendor tools and libraries, such as the@umbraco-cms/mcp-devutility vianpxand theUmbraco.Cms.Web.Websitepackage via the .NET NuGet registry.- [DATA_EXFILTRATION]: Instructions and scripts within the skill include settings to bypass TLS certificate validation, specifically throughNODE_TLS_REJECT_UNAUTHORIZED=0andcurl -sk. The providedinstance.shscript enforces a check that restricts this insecure behavior tolocalhostand127.0.0.1, which is a standard approach for handling self-signed development certificates during local testing.
Audit Metadata