xmake-scripting

Pass

Audited by Gen Agent Trust Hub on May 8, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill documents Xmake's built-in APIs for executing shell commands and provides explicit security guidance on preventing command injection by using vector-based arguments (e.g., os.execv) instead of string concatenation.\n- [EXTERNAL_DOWNLOADS]: Mentions Xmake's native capabilities for network operations via the net.http and devel.git modules, which are standard features for downloading build dependencies.\n- [REMOTE_CODE_EXECUTION]: Describes the documented and legitimate process for creating, building, and loading native C/C++ Lua modules to extend the build system's functionality.\n- [SAFE]: The documentation is authored by the official vendor, provides security warnings against common pitfalls, and describes standard build tool features without malicious intent.
Audit Metadata
Risk Level
SAFE
Analyzed
May 8, 2026, 12:02 PM
Security Audit — agent-trust-hub — xmake-scripting