xmake-scripting
Pass
Audited by Gen Agent Trust Hub on May 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill documents Xmake's built-in APIs for executing shell commands and provides explicit security guidance on preventing command injection by using vector-based arguments (e.g.,
os.execv) instead of string concatenation.\n- [EXTERNAL_DOWNLOADS]: Mentions Xmake's native capabilities for network operations via thenet.httpanddevel.gitmodules, which are standard features for downloading build dependencies.\n- [REMOTE_CODE_EXECUTION]: Describes the documented and legitimate process for creating, building, and loading native C/C++ Lua modules to extend the build system's functionality.\n- [SAFE]: The documentation is authored by the official vendor, provides security warnings against common pitfalls, and describes standard build tool features without malicious intent.
Audit Metadata