dependency-confusion
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill serves as an educational guide for developers on preventing supply chain vulnerabilities such as dependency confusion and typosquatting.
- [COMMAND_EXECUTION]: The skill includes benign shell commands and configuration snippets (e.g.,
npm config set ignore-scripts true) intended to demonstrate security hardening techniques. - [DATA_EXPOSURE_AND_EXFILTRATION]: Configuration examples use standard environment variable placeholders (e.g.,
${NPM_TOKEN}) rather than hardcoded credentials, which is a recommended security practice.
Audit Metadata