install-anti-slop
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill includes a Node.js script (
scripts/install.mjs) used to copy bundled plugin assets into a project's local tooling directory. It also requires the execution of package manager commands (e.g.,npm view,npm install) to manage dependencies. - [EXTERNAL_DOWNLOADS]: The skill facilitates the download and installation of
oxlintand@oxlint/pluginsfrom the NPM registry. These are well-known packages from an established registry, used here to support the skill's primary function of code linting. - [INDIRECT_PROMPT_INJECTION]: The installation and update procedures require the agent to read existing repository files, such as local agent instructions, configuration files, and Git status. While this is a necessary step for its intended purpose, it represents an attack surface where malicious data within a repository could attempt to influence the agent's behavior.
Audit Metadata