xmake-introspection

Pass

Audited by Gen Agent Trust Hub on Sep 9, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses xmake, xrepo, and standard shell utilities such as ls, cat, and grep to query project state, list environment variables, and inspect configuration files like .xmake/xmake.conf within the project directory.
  • [DYNAMIC_EXECUTION]: The skill utilizes xmake l -c to execute Lua scripts. These scripts are provided as templates to programmatically access internal Xmake modules for extracting source files, target dependencies, and configuration settings.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes project metadata and tool outputs derived from xmake.lua files. Since these files are project-controlled scripts, they represent an attack surface where malicious project definitions could attempt to influence the agent's interpretation of the build environment, which is a standard risk for build-system introspection tools.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 9, 2026, 09:52 AM
Security Audit — agent-trust-hub — xmake-introspection