nix-packaging-best-practices
Pass
Audited by Gen Agent Trust Hub on Apr 10, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is entirely educational, providing templates and guides for NixOS packaging. It promotes security best practices such as using cryptographic hashes for external downloads via
fetchurl. - [COMMAND_EXECUTION]: The skill references standard Nix ecosystem commands (e.g.,
nix-build,nix-shell,nix-locate) and common archive utility commands (tar,unzip,ar,rpm2cpio) intended for use within the Nix build sandbox. These operations are standard for the packaging lifecycle and do not represent a security risk. - [EXTERNAL_DOWNLOADS]: Guidelines for using
fetchurlare provided, which is the standard Nix method for sourcing remote files. The documentation correctly emphasizes the use ofsha256hashes to ensure the integrity and authenticity of downloaded archives. - [SAFE]: No evidence of prompt injection, data exfiltration, obfuscation, or persistence mechanisms was found. The skill adheres to the principles of reproducibility and isolation inherent in the Nix build system.
Audit Metadata