formal-verify

Pass

Audited by Gen Agent Trust Hub on Apr 2, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The install-deps.sh script fetches the Apalache formal verification engine directly from its official GitHub repository releases and installs several Python libraries from the standard PyPI registry.
  • [COMMAND_EXECUTION]: The suite utilizes subprocess to orchestrate several development and analysis tools, including git for incremental analysis, radon and lizard for complexity metrics, and swiftlint for Swift code style enforcement.
  • [REMOTE_CODE_EXECUTION]: The skill installs and executes the Apalache verification binary to process TLA+ state-machine specifications, which is a standard procedure for behavioral verification workflows.
  • [SAFE]: Employs dynamic Python module loading in verify-behavioral.py to execute locally-authored verification specs from the .verifier/specs/ directory, which is a required function for project-specific behavioral auditing.
  • [SAFE]: Starts a background daemon for the Apalache server using nohup to facilitate faster verification runs, which is a documented and standard operational feature for this toolset.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 2, 2026, 07:19 PM