helmor-bump-vendors

Pass

Audited by Gen Agent Trust Hub on Jul 15, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructions and associated scripts facilitate downloading data from several well-known technical services:
  • Fetches package metadata and tarballs from the official npm registry (registry.npmjs.org) to compute integrity hashes.
  • Retrieves release information and assets from the GitHub API (api.github.com) and official repositories for tools like gh, glab, and cloudflared.
  • Downloads checksums and binaries from nodejs.org for runtime management.
  • [COMMAND_EXECUTION]: The workflow involves executing standard development and verification commands:
  • Dependency management and script execution using bun.
  • Integrity verification using the shasum utility.
  • Automated testing and build validation via cargo test and bun run build to ensure project stability after dependency updates.
  • [DATA_EXPOSURE]: The skill requires reading and modifying local configuration files (sidecar/package.json and sidecar/scripts/vendor-platform.ts) to update version pins and SHA256 checksums, which is the intended functional purpose of the tool.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 15, 2026, 12:22 AM
Security Audit — agent-trust-hub — helmor-bump-vendors