typescript-code-and-test-standards
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructions direct the agent to detect and execute shell commands defined within the project being analyzed. Specifically, it looks for and runs scripts from
package.json,Makefile,justfile, andTaskfile.ymlto perform formatting, linting, type-checking, and testing. This creates a surface where the agent executes commands defined in external project files. - [INDIRECT_PROMPT_INJECTION]: The skill operates by ingesting and processing untrusted data from the repository, including source code and various configuration files, to determine its behavior and review criteria.
- Ingestion points: The skill reads files matching multiple extensions (
.ts,.js, etc.) and configuration files likepackage.json,tsconfig.json, andeslint.config.jsto adapt its analysis to the project environment. - Boundary markers: The instructions include a precedence logic that prioritizes project-specific rules files (e.g.,
CLAUDE.md,AGENTS.md) as authoritative boundaries for the agent's behavior. - Capability inventory: The skill possesses the capability to execute shell commands for testing and validation, and it generates code review findings based on analyzed inputs.
- Sanitization: The skill provides a safety mechanism by instructing the agent to redact credentials, tokens, and other sensitive values (
[REDACTED]) before outputting findings to the user.
Audit Metadata