node-version-discipline
Pass
Audited by Gen Agent Trust Hub on Oct 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell scripts to perform environment detection, version switching, and project initialization. It leverages common tools such as
nvm,grep,sed, andfindto manage the Node.js environment. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from local project files to determine the required runtime environment, which constitutes an indirect injection surface.
- Ingestion points: Reads contents of
.nvmrc,.node-version,.tool-versions,package.json, and various CI/Docker configuration files via the detection script inSKILL.md. - Boundary markers: None explicitly defined in the file-reading logic.
- Capability inventory: The skill can execute shell commands through the version manager and perform file write operations to persist configuration choices.
- Sanitization: Uses strict regular expression filtering (
v?[0-9]+(\.[0-9]+){0,2}) to ensure that only valid version strings are extracted and used in subsequent shell commands, mitigating potential command injection from malicious configuration files. - [DYNAMIC_EXECUTION]: Employs
node -eone-liners to perform lightweight, read-only JSON parsing of the project'spackage.jsonfile to extract metadata fields likeenginesandvolta.
Audit Metadata