nvm-global-packages
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill provides instructions and examples for installing Node.js packages globally using
nvm install. This process involves downloading and executing code from the npm registry or remote repositories (e.g.,stevemao/left-pad). These actions are standard for the documented tool and reference well-known community resources. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied version identifiers and package names as arguments for
nvmcommands. While this presents an attack surface where a malicious input could potentially lead to the installation of an unintended package, the skill follows standard documentation practices for CLI tools.
Audit Metadata