yy-create-node-script
Warn
Audited by Gen Agent Trust Hub on Jul 16, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The
scripts/package.jsontemplate contains multiple dependencies with version numbers that are significantly higher than current stable releases (e.g.,typescript@6.0.3,eslint@10.4.1,cross-env@10.1.0). These unverifiable versions pose a supply chain threat if squatted on the public NPM registry. - [COMMAND_EXECUTION]: The
SKILL.mdinstructions (Step 6) authorize the agent to executenpm installwithin the created project directory. This action would fetch and execute installation scripts from the unverified package versions defined in the template, potentially leading to remote code execution.
Audit Metadata