add-new-package
Pass
Audited by Gen Agent Trust Hub on Jul 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [SAFE]: The skill follows standard development practices for creating package scaffolding in a monorepo environment. The instructions are transparent and align with the stated purpose.
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands such as
bun i(install dependencies) andbun run make(build the package). These are standard operations for JavaScript/TypeScript development and occur within the local project context. - [EXTERNAL_DOWNLOADS]: The
bun icommand will download project dependencies from a package registry (e.g., NPM). This is the intended behavior for managing package dependencies in this environment. - [DATA_EXPOSURE]: The skill mentions the use of an environment file
../.env.bundle. This is a common pattern for managing build-time configurations or secrets locally and does not indicate exfiltration behavior.
Audit Metadata