app-startup-and-bootstrap
Pass
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No security issues were identified. The skill provides boilerplate templates and a static analysis script (
check-startup.mjs) for development purposes. The script performs local filesystem operations to verify app architecture rules. - [COMMAND_EXECUTION]: The utility library
scripts/check-lib.mjscontains arunNodefunction that usesspawnSyncto execute scripts. This is used solely for the skill's own self-test suite (scripts/selftest.mjs) and does not represent an arbitrary execution vulnerability. - [EXTERNAL_DOWNLOADS]: The documentation and schema files include references to
expo.devandjson-schema.org. These are well-known, trusted services and do not pose a security risk.
Audit Metadata