ts-config

Pass

Audited by Gen Agent Trust Hub on Sep 29, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted local data (existing tsconfig.json and package.json files) during its initialization phase.
  • Ingestion points: The explore-codebase sub-agent reads local configuration files to determine the project runtime and existing settings.
  • Boundary markers: No specific delimiters or "ignore instructions" warnings are defined for the read operation.
  • Capability inventory: The skill is capable of modifying filesystem configuration and querying external documentation via sub-agents.
  • Sanitization: The output is restricted to structured JSON configuration following the TypeScript schema, which inherently limits injection vectors.
  • [EXTERNAL_DOWNLOADS]: The skill references official and well-known documentation sources.
  • Fetches current flag behaviors from the official Microsoft TypeScript GitHub repository via the query-docs tool.
  • References runtime documentation from established domains including typescriptlang.org, bun.sh, and nodejs.org.
  • [SAFE]: The skill demonstrates standard development utility behavior. All sub-agents (fuse-ai-pilot) and referenced tools are consistent with the author's (fusengine) ecosystem. No patterns related to credential harvesting, persistence, or command injection were found.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 29, 2026, 06:13 AM