Skills
Navigate
skills/full-stack-skills/nvm-skills/nvm-mirror-and-auth/Gen Agent Trust Hub

nvm-mirror-and-auth

Pass

Audited by Gen Agent Trust Hub on Oct 6, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill instructions and examples guide the agent to construct shell commands using untrusted data provided by the user, such as mirror URLs and authentication tokens.
  • Ingestion points: User-provided values for NVM_NODEJS_ORG_MIRROR, NVM_IOJS_ORG_MIRROR, and NVM_AUTH_HEADER as defined in examples/mirror.md and examples/mirror-auth-header.md.
  • Boundary markers: Absent. The skill does not provide delimiters or instructions for the agent to treat these external inputs as untrusted content.
  • Capability inventory: The skill facilitates the execution of shell environment configuration and nvm install commands via the constructed variables.
  • Sanitization: Absent. There are no guidelines or examples showing how to escape, validate, or sanitize user-supplied URLs or tokens before they are interpolated into the shell environment.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 6, 2026, 01:34 PM