system-create-cli
Pass
Audited by Gen Agent Trust Hub on Mar 13, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements a structured workflow for dynamic code generation that prioritizes type safety and validation. It specifically mandates TypeScript strict mode and provides patterns for utilizing the 'zod' library to validate configuration and input schemas, mitigating common injection and data-handling vulnerabilities.
- [SAFE]: External dependencies referenced throughout the skill (e.g., 'commander', 'zod', 'vitest') are well-established, legitimate packages within the TypeScript and Node.js ecosystems. References to these packages and the Bun runtime represent standard, expected development practices.
- [SAFE]: Command execution patterns found in reference files (such as 'execSync' in 'cli-examples-advanced.md') are confined to the context of automated testing of the generated CLI tools. These patterns are illustrative examples for developers and do not constitute hidden or malicious execution.
- [SAFE]: Regarding potential architectural risks related to Indirect Prompt Injection (Category 8): Ingestion points include user-provided CLI requirements; Capability inventory includes the generation of tools capable of network (fetch) and file I/O operations; Sanitization is addressed via the recommendation of schema validation and type-safe interfaces. The skill focuses on generating tools for the user's own environment with clear instructions to verify paths and configurations.
- [SAFE]: File system operations described in the patterns (e.g., reading from '.env' files) follow industry standards for CLI configuration management. There is no evidence of attempts to access sensitive system files or exfiltrate data.
Audit Metadata