makefile-validator
Pass
Audited by Gen Agent Trust Hub on Mar 5, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill's primary validation script,
scripts/validate_makefile.sh, fetches thembakepackage from the official Python Package Index (PyPI) at runtime. This download targets a well-known, trusted service and is performed within an isolated virtual environment.\n- [COMMAND_EXECUTION]: The skill executes local commands to perform its validation tasks, includingpython3for virtual environment management,pip3for dependency installation, andmake -n --dry-runto verify the syntax of the targeted Makefile without executing its recipes.\n- [CREDENTIALS_UNSAFE]: An example fileexamples/bad-makefile.mkcontains dummy API keys and passwords (e.g.,sk-1234567890abcdef). These are clearly marked as anti-patterns and are used solely as test cases to demonstrate the linter's ability to detect hardcoded secrets.
Audit Metadata