xmake-async-jobs
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill documents the use of
os.vrunvandos.execto run external processes such as compilers, protocol buffer generators, and downloaders. - Evidence: Examples show the execution of
curl,protoc, and generic compiler strings withinasync.runjobscallbacks. - Context: These operations are the primary and intended purpose of an Xmake build skill and follow the tool's standard API for safe execution (using argument lists instead of raw shell strings).
- [INDIRECT_PROMPT_INJECTION]: The skill describes patterns that ingest external data (like a list of URLs or file names) and process them through the job scheduler.
- Ingestion points: The
urlsvariable in batch download examples and thesourcebatch.sourcefilesobject in build rules. - Boundary markers: None present in the simplified documentation examples.
- Capability inventory: Access to the filesystem via
osmodules and network access viacurlsubprocesses. - Sanitization: The examples use
os.vrunvwhich passes arguments directly to the process, providing inherent protection against common shell metacharacter injection.
Audit Metadata