yarn
Pass
Audited by Gen Agent Trust Hub on Jul 8, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill documents standard usage of the Yarn package manager. All URL references point to the official
yarnpkg.comdomain, the npm registry, or well-known services like GitHub. - [EXTERNAL_DOWNLOADS]: The instructions guide users and agents to use official tools like
corepackandyarnto download binaries and packages from established, well-known registries. This is the intended primary function of a package manager skill. - [COMMAND_EXECUTION]: The skill describes standard CLI commands such as
yarn install,yarn run, andyarn dlx. While these commands involve executing scripts or remote binaries, they are presented as standard development workflows for the Yarn tool. - [CREDENTIALS_UNSAFE]: The documentation specifically encourages safe credential management by demonstrating how to use environment variables (e.g.,
${NPM_TOKEN}) in configuration files rather than hardcoding sensitive tokens.
Audit Metadata