xmake-rules

Pass

Audited by Gen Agent Trust Hub on Sep 21, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The skill provides templates for defining custom build rules using Lua-based hooks such as on_load and before_buildcmd_file. These hooks execute logic at runtime within the Xmake build environment to configure targets and generate build commands.
  • [COMMAND_EXECUTION]: The custom protobuf rule example demonstrates how to invoke external command-line utilities using batchcmds:vrunv. Specifically, it shows the execution of the protoc compiler with arguments derived from project files.
  • [INDIRECT_PROMPT_INJECTION]: The provided rule templates ingest file paths and source content to perform transformations (e.g., utils.replace and utils.bin2c). This creates a surface where the build process reacts to project data, though no unsafe interpolation or exfiltration vectors are present.
  • Ingestion points: File paths provided to add_files and sourcefile variables in custom rules (SKILL.md).
  • Boundary markers: None explicitly shown in templates, which is standard for build configuration snippets.
  • Capability inventory: File system access (path.join, mkdir), external command execution (vrunv), and target metadata modification (target:add).
  • Sanitization: None present in the code snippets; relies on the underlying Xmake framework's handling of arguments.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 21, 2026, 12:41 PM
Security Audit — agent-trust-hub — xmake-rules