xmake-introspection
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
xmake,xrepo, and standard shell utilities such asls,cat, andgrepto query project state, list environment variables, and inspect configuration files like.xmake/xmake.confwithin the project directory. - [DYNAMIC_EXECUTION]: The skill utilizes
xmake l -cto execute Lua scripts. These scripts are provided as templates to programmatically access internal Xmake modules for extracting source files, target dependencies, and configuration settings. - [INDIRECT_PROMPT_INJECTION]: The skill processes project metadata and tool outputs derived from
xmake.luafiles. Since these files are project-controlled scripts, they represent an attack surface where malicious project definitions could attempt to influence the agent's interpretation of the build environment, which is a standard risk for build-system introspection tools.
Audit Metadata