datocms-cli
Pass
Audited by Gen Agent Trust Hub on May 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill is centered around executing the DatoCMS CLI via
npxor local package managers. It includes robust logic for environment detection (e.g., checking forpackage.jsonordatocms.config.json) and handles TTY vs. non-TTY execution scenarios correctly. - [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of the
datocmsCLI and official plugins (such as WordPress and Contentful importers) from npm and GitHub. These resources are official vendor tools provided by the author (datocms) and are handled through standard package management workflows. - [DATA_EXFILTRATION]: While the skill manages sensitive Content Management API (CMA) tokens, it incorporates secure token resolution logic. It encourages the use of OAuth (
datocms login) and linked profiles rather than hardcoding credentials in the repository or environment files. - [DYNAMIC_EXECUTION]: The
cma:scriptfunctionality allows the agent to execute arbitrary TypeScript code against the DatoCMS API. This is a core feature of the CLI and is documented with necessary safety precautions, including the use of isolated workspaces for type-checking and explicit requirements for user confirmation when modifying production schemas.
Audit Metadata