nvm-global-packages
Pass
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides guidance on using the nvm utility, a standard tool in the Node.js ecosystem, for its intended purpose of version and package management.
- [EXTERNAL_DOWNLOADS]: The skill references installation instructions and documentation from the nvm-sh/nvm repository on GitHub, which is a well-known and trusted source.
- [PROMPT_INJECTION]: The use of the $NVM_DIR/default-packages file represents an indirect prompt injection surface, as the nvm utility automatically executes installations based on this file's content. This is an inherent feature of the documented tool rather than a malicious addition.
- Ingestion points: examples/default-global-packages.md describes the use of the $NVM_DIR/default-packages file.
- Boundary markers: Absent in the simple package list format.
- Capability inventory: Shell command execution for global package installation via nvm.
- Sanitization: None described in the documentation.
Audit Metadata