c15t
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses shell commands such as 'find' to locate documentation files within the local 'node_modules' directory. These commands are scoped to discovery of local files necessary for the skill's primary function.
- [REMOTE_CODE_EXECUTION]: The skill provides instructions for running the vendor's own CLI tool (@c15t/cli) via 'npx'. The skill explicitly mandates that the agent must confirm the exact version with the user before execution and restricts execution to vendor-scoped packages (@c15t/*), mitigating risks of executing unauthorized third-party code.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from local documentation files (READMEs) stored within the 'node_modules' folder. This represents a standard surface for a developer tool that interprets local project configuration and documentation.
- [SAFE_PRACTICES]: The skill includes a dedicated security section that instructs the agent to use exact pinned versions and avoid executing non-vendor packages, demonstrating alignment with secure development practices.
Audit Metadata