setup-better-typescript
Pass
Audited by Gen Agent Trust Hub on Aug 30, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches the
@better-typescript/better-typescriptpackage from the npm registry as a development dependency.\n- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands usingnpmorbunto install the linter and run the configured linting script (lint:bts).\n- [INDIRECT_PROMPT_INJECTION]: The skill processes project configuration files and user-defined rules, which represents an attack surface for instructions embedded in project data.\n - Ingestion points: Reads
package.json,tsconfig.json, and project lockfiles from the repository root or workspaces to detect the package manager and project structure.\n - Boundary markers: Absent; the instructions do not specify the use of delimiters or specific security wrappers when reading or parsing these files.\n
- Capability inventory: Includes package installation (
npm install), file modification (package.json), file creation (better-typescript.json), and script execution (npm run).\n - Sanitization: Absent; the skill does not explicitly mention validating or sanitizing the content of the ingested files before using their data to generate configurations or execute commands.
Audit Metadata