node-version-discipline

Pass

Audited by Gen Agent Trust Hub on Oct 28, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes shell scripts to perform environment detection, version switching, and project initialization. It leverages common tools such as nvm, grep, sed, and find to manage the Node.js environment.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests data from local project files to determine the required runtime environment, which constitutes an indirect injection surface.
  • Ingestion points: Reads contents of .nvmrc, .node-version, .tool-versions, package.json, and various CI/Docker configuration files via the detection script in SKILL.md.
  • Boundary markers: None explicitly defined in the file-reading logic.
  • Capability inventory: The skill can execute shell commands through the version manager and perform file write operations to persist configuration choices.
  • Sanitization: Uses strict regular expression filtering (v?[0-9]+(\.[0-9]+){0,2}) to ensure that only valid version strings are extracted and used in subsequent shell commands, mitigating potential command injection from malicious configuration files.
  • [DYNAMIC_EXECUTION]: Employs node -e one-liners to perform lightweight, read-only JSON parsing of the project's package.json file to extract metadata fields like engines and volta.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 28, 2026, 05:11 AM