ts-lint-format
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill mandates a workflow involving external data ingestion which presents a vulnerability surface for indirect prompt injection.
- Ingestion points: The mandatory workflow in
SKILL.mdrequires spawning agents to perform web research (fuse-ai-pilot:research-expertvia Context7/Exa) and query external documentation (mcp__context7__query-docs). - Boundary markers: Absent. The instructions do not provide delimiters or warnings to ignore embedded instructions within the data retrieved during the research phase.
- Capability inventory: The skill utilizes shell execution for project initialization, package installation, and tool configuration (
npm,npx,biome,eslint) as documented inreferences/biome-setup.mdandreferences/eslint-typed.md. - Sanitization: Absent. There is no evidence of content filtering or validation for the data retrieved from external research before it influences the agent's actions.
- [EXTERNAL_DOWNLOADS]: The skill references and fetches resources from official, well-known technology providers.
- Fetches the official Biome JSON schema from
biomejs.devinreferences/templates/config-examples.md. - Directs agents to consult documentation from official sources including
biomejs.devandtypescript-eslint.io.
Audit Metadata