skills/espennilsen/pi/npmjs/Gen Agent Trust Hub

npmjs

Pass

Audited by Gen Agent Trust Hub on Oct 9, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests data from local package manifests, git logs, and registry metadata. 1. Ingestion points: Reads local package.json contents, git log output, and remote package metadata via npm view. 2. Boundary markers: No explicit delimiters are used when processing this data. 3. Capability inventory: The skill can execute npm publish, git tag, and git push. 4. Sanitization: No sanitization is performed on ingested data before it is presented to the agent.
  • [COMMAND_EXECUTION]: Executes standard development lifecycle commands including npm version, npm publish, git tag, and git push. These operations are consistent with the skill's primary purpose.
  • [EXTERNAL_DOWNLOADS]: Fetches package information from the npm registry using npm view and potentially downloads the TypeScript compiler via npx tsc or packages during a temporary test installation. These actions target the official npm registry.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 9, 2026, 11:41 AM