tsdown
Pass
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill serves as a documentation repository and reference for the
tsdownbuild tool. It provides guidance on configuration, CLI options, and typical library development workflows. - [SAFE]: All external URLs reference the official project domain (
tsdown.dev) or the associated GitHub repository (github.com/rolldown/tsdown). - [SAFE]: Suggested dependencies and CLI utilities (e.g.,
typescript,publint,lightningcss,sass) are standard, well-known packages in the JavaScript/TypeScript ecosystem used for intended development purposes. - [INDIRECT_PROMPT_INJECTION]: The skill workflow involves inspecting local project files such as
package.jsonandtsdown.config.ts. While this ingestion of external data constitutes an attack surface, it is fundamental to the skill's purpose as a configuration assistant and lacks any identified malicious interpolation or instruction-override patterns. - Ingestion points:
package.json,tsdown.config.ts(referenced inSKILL.mdWorkflow section). - Boundary markers: None identified.
- Capability inventory: Suggestions for local command execution via
bunxfor building and migration (SKILL.md,references/config-cli.md). - Sanitization: None identified.
Audit Metadata