biome
Pass
Audited by Gen Agent Trust Hub on Oct 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to execute
@biomejs/biomevianpx. This is the standard method for running the official Biome toolchain and targets a well-known, legitimate package registry. - [COMMAND_EXECUTION]: The skill includes several CLI commands for project initialization (
biome init) and code verification (biome check,biome ci). These are standard development operations restricted to the local workspace. - [INDIRECT_PROMPT_INJECTION]: The skill identifies a data ingestion surface through its core function of processing codebase files for linting and formatting. Evidence Chain:
- Ingestion points: Source code files (JavaScript, TypeScript, JSX, JSON) processed by the tool.
- Boundary markers: Not present in the provided instructions.
- Capability inventory: Command execution via
npxand local file system modification via the--writeflag. - Sanitization: Not applicable to these standard CLI tool instructions.
Audit Metadata