helmor-bump-vendors
Pass
Audited by Gen Agent Trust Hub on Jul 15, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructions and associated scripts facilitate downloading data from several well-known technical services:
- Fetches package metadata and tarballs from the official npm registry (
registry.npmjs.org) to compute integrity hashes. - Retrieves release information and assets from the GitHub API (
api.github.com) and official repositories for tools likegh,glab, andcloudflared. - Downloads checksums and binaries from
nodejs.orgfor runtime management. - [COMMAND_EXECUTION]: The workflow involves executing standard development and verification commands:
- Dependency management and script execution using
bun. - Integrity verification using the
shasumutility. - Automated testing and build validation via
cargo testandbun run buildto ensure project stability after dependency updates. - [DATA_EXPOSURE]: The skill requires reading and modifying local configuration files (
sidecar/package.jsonandsidecar/scripts/vendor-platform.ts) to update version pins and SHA256 checksums, which is the intended functional purpose of the tool.
Audit Metadata