ts-lint-format

Pass

Audited by Gen Agent Trust Hub on Sep 7, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill mandates a workflow involving external data ingestion which presents a vulnerability surface for indirect prompt injection.
  • Ingestion points: The mandatory workflow in SKILL.md requires spawning agents to perform web research (fuse-ai-pilot:research-expert via Context7/Exa) and query external documentation (mcp__context7__query-docs).
  • Boundary markers: Absent. The instructions do not provide delimiters or warnings to ignore embedded instructions within the data retrieved during the research phase.
  • Capability inventory: The skill utilizes shell execution for project initialization, package installation, and tool configuration (npm, npx, biome, eslint) as documented in references/biome-setup.md and references/eslint-typed.md.
  • Sanitization: Absent. There is no evidence of content filtering or validation for the data retrieved from external research before it influences the agent's actions.
  • [EXTERNAL_DOWNLOADS]: The skill references and fetches resources from official, well-known technology providers.
  • Fetches the official Biome JSON schema from biomejs.dev in references/templates/config-examples.md.
  • Directs agents to consult documentation from official sources including biomejs.dev and typescript-eslint.io.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 7, 2026, 11:06 AM
Security Audit — agent-trust-hub — ts-lint-format