build-raycast-script-command
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The utility script
scripts/preview-script.shis designed to execute local shell or Python scripts to capture and preview their output. This is a fundamental capability required for testing Raycast commands. - [DYNAMIC_EXECUTION]: The metadata validation utility
scripts/check-raycast-script-metadata.shexecutes an embedded Python script via stdin (python3 -) to perform regex-based analysis of script headers. - [INDIRECT_PROMPT_INJECTION]: The skill interacts with external script files in the development workspace, which represents a potential attack surface for indirect prompt injection if those files contain malicious instructions meant to influence the agent during analysis or preview.
- Ingestion points: File reading occurs in
scripts/check-raycast-script-metadata.sh, and execution occurs inscripts/preview-script.sh. - Boundary markers: No specific delimiters or safety warnings are implemented for processing script content.
- Capability inventory: The skill provides capabilities for local file read access and local code execution.
- Sanitization: No sanitization or sandboxing is applied to the script content prior to analysis or execution.
- [EXTERNAL_DOWNLOADS]: The
README.mdfile contains installation instructions referencing the author's official repository via theskillsCLI andnpx. These are legitimate vendor-owned installation paths.
Audit Metadata