xmake-async-jobs

Pass

Audited by Gen Agent Trust Hub on Sep 21, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill documents the use of os.vrunv and os.exec to run external processes such as compilers, protocol buffer generators, and downloaders.
  • Evidence: Examples show the execution of curl, protoc, and generic compiler strings within async.runjobs callbacks.
  • Context: These operations are the primary and intended purpose of an Xmake build skill and follow the tool's standard API for safe execution (using argument lists instead of raw shell strings).
  • [INDIRECT_PROMPT_INJECTION]: The skill describes patterns that ingest external data (like a list of URLs or file names) and process them through the job scheduler.
  • Ingestion points: The urls variable in batch download examples and the sourcebatch.sourcefiles object in build rules.
  • Boundary markers: None present in the simplified documentation examples.
  • Capability inventory: Access to the filesystem via os modules and network access via curl subprocesses.
  • Sanitization: The examples use os.vrunv which passes arguments directly to the process, providing inherent protection against common shell metacharacter injection.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 21, 2026, 12:38 PM
Security Audit — agent-trust-hub — xmake-async-jobs