xmake-scripting

Pass

Audited by Gen Agent Trust Hub on Sep 21, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill documents various built-in functions for executing system commands (e.g., os.exec, os.execv, os.iorun). Crucially, the documentation includes a 'Common pitfalls' section that warns developers against shell injection when using string concatenation for command arguments and promotes the use of list-based argument passing (*v forms) as a secure alternative. This is an educational safety best practice.
  • [DYNAMIC_EXECUTION]: The skill provides instructions on using Xmake's import() mechanism to load Lua modules and building native C/C++ shared modules. These are standard features of the Xmake build environment for extending build logic and are documented with appropriate architectural boundaries (e.g., module privacy rules).
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 21, 2026, 12:41 PM
Security Audit — agent-trust-hub — xmake-scripting