pnpm
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill consists of documentation and reference guides for pnpm, a standard Node.js package manager. It provides accurate information on CLI commands and configuration files.
- [SAFE]: Mention of sensitive configuration files like
.npmrcis contextually appropriate for documenting authentication and registry settings. No instructions to exfiltrate or leak credentials were found. - [SAFE]: Command execution examples, including destructive commands like
rm -rfin the rollback section, are standard developer workflows and are clearly documented as manual maintenance steps. - [SAFE]: Remote code execution capabilities like
pnpxandpnpm dlxare core features of the tool being documented and are presented safely within the context of package management. - [SAFE]: The skill includes information on supply-chain security, such as build approval (
allowBuilds) and release age controls, encouraging secure usage of the package manager.
Audit Metadata