aelf-skills-hub

Pass

Audited by Gen Agent Trust Hub on Apr 7, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The repository contains the bootstrap.sh script and various TypeScript utilities that invoke shell commands like git, npm, bun, and tar. These are used appropriately to manage the downloading and local preparation of skills from the aelf ecosystem.\n- [EXTERNAL_DOWNLOADS]: The hub fetches skill source code and packages from the npm registry and official GitHub repositories. These downloads are directed to well-known infrastructure associated with the aelf project and its partners.\n- [REMOTE_CODE_EXECUTION]: The skill catalog includes installCommand entries that use bunx to run setup scripts from scoped npm packages. This mechanism is the intended way to configure skills for different AI clients (e.g., Cursor, Claude) and is performed within a trusted package scope.\n- [SAFE]: The inclusion of a built-in security audit tool (security-audit.ts) to detect risky shell patterns demonstrates a proactive approach to maintaining the integrity of the skill catalog.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 7, 2026, 08:08 AM