ts-runtime-node
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill workflow involves inspecting local project configuration files which are externally controlled. * Ingestion points: The SKILL.md agent workflow uses fuse-ai-pilot:explore-codebase to inspect package.json and tsconfig.json. * Boundary markers: Absent. No delimiters or specific instructions to ignore embedded content are provided. * Capability inventory: The skill enables shell command execution via node, npm, and npx tools across several scripts. * Sanitization: Absent. Content from project files is processed without explicit validation or sanitization.
- [EXTERNAL_DOWNLOADS]: The skill references the installation of the tsx package from a standard registry. * Evidence: npm install --save-dev tsx in references/tsx-when-needed.md. * Context: The reference targets a well-known community package for TypeScript execution.
- [COMMAND_EXECUTION]: The skill provides numerous examples of standard Node.js development commands. * Evidence: Use of node --watch, node --test, and npm scripts in references/templates/node-esm-setup.md. * Context: These are standard operations for the skill's stated purpose of managing a Node.js runtime environment.
Audit Metadata