xmake-rules
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill provides templates for defining custom build rules using Lua-based hooks such as
on_loadandbefore_buildcmd_file. These hooks execute logic at runtime within the Xmake build environment to configure targets and generate build commands. - [COMMAND_EXECUTION]: The custom
protobufrule example demonstrates how to invoke external command-line utilities usingbatchcmds:vrunv. Specifically, it shows the execution of theprotoccompiler with arguments derived from project files. - [INDIRECT_PROMPT_INJECTION]: The provided rule templates ingest file paths and source content to perform transformations (e.g.,
utils.replaceandutils.bin2c). This creates a surface where the build process reacts to project data, though no unsafe interpolation or exfiltration vectors are present. - Ingestion points: File paths provided to
add_filesandsourcefilevariables in custom rules (SKILL.md). - Boundary markers: None explicitly shown in templates, which is standard for build configuration snippets.
- Capability inventory: File system access (
path.join,mkdir), external command execution (vrunv), and target metadata modification (target:add). - Sanitization: None present in the code snippets; relies on the underlying Xmake framework's handling of arguments.
Audit Metadata