datocms-cli

Pass

Audited by Gen Agent Trust Hub on May 20, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill is centered around executing the DatoCMS CLI via npx or local package managers. It includes robust logic for environment detection (e.g., checking for package.json or datocms.config.json) and handles TTY vs. non-TTY execution scenarios correctly.
  • [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of the datocms CLI and official plugins (such as WordPress and Contentful importers) from npm and GitHub. These resources are official vendor tools provided by the author (datocms) and are handled through standard package management workflows.
  • [DATA_EXFILTRATION]: While the skill manages sensitive Content Management API (CMA) tokens, it incorporates secure token resolution logic. It encourages the use of OAuth (datocms login) and linked profiles rather than hardcoding credentials in the repository or environment files.
  • [DYNAMIC_EXECUTION]: The cma:script functionality allows the agent to execute arbitrary TypeScript code against the DatoCMS API. This is a core feature of the CLI and is documented with necessary safety precautions, including the use of isolated workspaces for type-checking and explicit requirements for user confirmation when modifying production schemas.
Audit Metadata
Risk Level
SAFE
Analyzed
May 20, 2026, 07:35 PM
Security Audit — agent-trust-hub — datocms-cli