nvm-shell-integration

Pass

Audited by Gen Agent Trust Hub on Jun 23, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides scripts that hook into shell directory changes to automate Node.js version management via NVM commands.
  • Evidence: examples/auto-use-bash.md implements a custom cd function; examples/auto-use-zsh.md uses the chpwd hook.
  • [EXTERNAL_DOWNLOADS]: The shell integration scripts may automatically trigger nvm install when entering a directory with an uninstalled Node.js version.
  • Evidence: Automated nvm install calls are present in the Bash, Fish, and Zsh examples.
  • Note: These operations target official Node.js distribution registries through the established NVM tool.
  • [PROMPT_INJECTION]: The skill processes project-specific .nvmrc files, which constitutes a surface for indirect instructions if a project repository contains a malicious configuration file.
  • Ingestion points: The scripts read the contents of .nvmrc files from the current directory.
  • Boundary markers: No specific delimiters or warnings for embedded content are included in the provided snippets.
  • Capability inventory: The scripts are capable of executing nvm install and nvm use based on file content.
  • Sanitization: Basic whitespace cleaning is performed in the Bash example to ensure valid version string processing.
  • Note: This is standard functionality for development environment managers and matches official documentation patterns.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 23, 2026, 04:19 PM
Security Audit — agent-trust-hub — nvm-shell-integration