setup-ts-deep-modules
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill installs the
dependency-cruiserutility as a development dependency using the project's detected package manager. This is a standard practice for development-focused skills. - [COMMAND_EXECUTION]: Executes shell commands to install packages and run linting checks (
depcruise). These operations are restricted to the local environment and are triggered as part of the setup and verification process. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the repository, specifically existing configuration files, which presents a theoretical indirect prompt injection surface.
- Ingestion points: Reads existing
.dependency-cruiser.*configuration files and lockfiles (pnpm-lock.yaml,yarn.lock,bun.lockb). - Boundary markers: Absent.
- Capability inventory: File system write access, package installation, and shell command execution.
- Sanitization: Absent; the skill instructs the agent to merge existing configurations without explicit validation of the contents.
Audit Metadata