stash-supply-chain-security
Pass
Audited by Gen Agent Trust Hub on Sep 27, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill documents and enforces standard security best practices for npm/pnpm monorepos, such as registry pinning to the official npm registry and disabling post-install scripts by default to minimize the risk of malicious package execution.
- [SAFE]: All external references and downloads target well-known security resources, official registries, or the author's own official GitHub repository infrastructure. These include resources from Snyk, Socket, and the npm registry.
- [SAFE]: Secret management guidance follows security best practices by explicitly advising against committing authentication tokens to the repository and recommending the use of environment variables and scoped GitHub Secrets.
- [SAFE]: The instructions for publishing packages utilize modern OIDC (OpenID Connect) trusted publishing and provenance attestations, which enhances security by removing the need for long-lived repository secrets.
Audit Metadata