tsdown

Pass

Audited by Gen Agent Trust Hub on Oct 3, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [SAFE]: The skill serves as a documentation repository and reference for the tsdown build tool. It provides guidance on configuration, CLI options, and typical library development workflows.
  • [SAFE]: All external URLs reference the official project domain (tsdown.dev) or the associated GitHub repository (github.com/rolldown/tsdown).
  • [SAFE]: Suggested dependencies and CLI utilities (e.g., typescript, publint, lightningcss, sass) are standard, well-known packages in the JavaScript/TypeScript ecosystem used for intended development purposes.
  • [INDIRECT_PROMPT_INJECTION]: The skill workflow involves inspecting local project files such as package.json and tsdown.config.ts. While this ingestion of external data constitutes an attack surface, it is fundamental to the skill's purpose as a configuration assistant and lacks any identified malicious interpolation or instruction-override patterns.
  • Ingestion points: package.json, tsdown.config.ts (referenced in SKILL.md Workflow section).
  • Boundary markers: None identified.
  • Capability inventory: Suggestions for local command execution via bunx for building and migration (SKILL.md, references/config-cli.md).
  • Sanitization: None identified.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 3, 2026, 11:14 AM