xmake-scripting
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill documents various built-in functions for executing system commands (e.g.,
os.exec,os.execv,os.iorun). Crucially, the documentation includes a 'Common pitfalls' section that warns developers against shell injection when using string concatenation for command arguments and promotes the use of list-based argument passing (*vforms) as a secure alternative. This is an educational safety best practice. - [DYNAMIC_EXECUTION]: The skill provides instructions on using Xmake's
import()mechanism to load Lua modules and building native C/C++ shared modules. These are standard features of the Xmake build environment for extending build logic and are documented with appropriate architectural boundaries (e.g., module privacy rules).
Audit Metadata