nvm-shell-integration
Pass
Audited by Gen Agent Trust Hub on Jun 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides scripts that hook into shell directory changes to automate Node.js version management via NVM commands.
- Evidence:
examples/auto-use-bash.mdimplements a customcdfunction;examples/auto-use-zsh.mduses thechpwdhook. - [EXTERNAL_DOWNLOADS]: The shell integration scripts may automatically trigger
nvm installwhen entering a directory with an uninstalled Node.js version. - Evidence: Automated
nvm installcalls are present in the Bash, Fish, and Zsh examples. - Note: These operations target official Node.js distribution registries through the established NVM tool.
- [PROMPT_INJECTION]: The skill processes project-specific
.nvmrcfiles, which constitutes a surface for indirect instructions if a project repository contains a malicious configuration file. - Ingestion points: The scripts read the contents of
.nvmrcfiles from the current directory. - Boundary markers: No specific delimiters or warnings for embedded content are included in the provided snippets.
- Capability inventory: The scripts are capable of executing
nvm installandnvm usebased on file content. - Sanitization: Basic whitespace cleaning is performed in the Bash example to ensure valid version string processing.
- Note: This is standard functionality for development environment managers and matches official documentation patterns.
Audit Metadata