dev
Pass
Audited by Gen Agent Trust Hub on May 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill manages the lifecycle of local development processes by executing tools such as
portless,emulate, andagent-browser. Thescripts/stop.shscript includes a robust process tree walker that recursively terminates descendant processes to prevent orphans. - [EXTERNAL_DOWNLOADS]: Utilizes
npx --yes wait-onto poll the development server's availability. This is a standard developer utility sourced from the npm registry used for network readiness checks. - [SAFE]: Input derived from the environment, specifically git branch names used for subdomain slugs, is sanitized in
scripts/boot.shusingtr -cd 'a-z0-9-'. This prevents command injection and ensures DNS compatibility. Features that expose the local environment to the public internet (via Tailscale Funnel) are explicitly documented and accompanied by clear security warnings.
Audit Metadata