build-raycast-script-command

Pass

Audited by Gen Agent Trust Hub on Oct 9, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The utility script scripts/preview-script.sh is designed to execute local shell or Python scripts to capture and preview their output. This is a fundamental capability required for testing Raycast commands.
  • [DYNAMIC_EXECUTION]: The metadata validation utility scripts/check-raycast-script-metadata.sh executes an embedded Python script via stdin (python3 -) to perform regex-based analysis of script headers.
  • [INDIRECT_PROMPT_INJECTION]: The skill interacts with external script files in the development workspace, which represents a potential attack surface for indirect prompt injection if those files contain malicious instructions meant to influence the agent during analysis or preview.
  • Ingestion points: File reading occurs in scripts/check-raycast-script-metadata.sh, and execution occurs in scripts/preview-script.sh.
  • Boundary markers: No specific delimiters or safety warnings are implemented for processing script content.
  • Capability inventory: The skill provides capabilities for local file read access and local code execution.
  • Sanitization: No sanitization or sandboxing is applied to the script content prior to analysis or execution.
  • [EXTERNAL_DOWNLOADS]: The README.md file contains installation instructions referencing the author's official repository via the skills CLI and npx. These are legitimate vendor-owned installation paths.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 9, 2026, 10:27 PM