antfu
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONPERSISTENCEINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes
@antfu/nifor dependency management andnlx(npx) to execute development tools likefast-npm-metafor efficient package metadata lookups. - [EXTERNAL_DOWNLOADS]: Configures GitHub Actions to utilize reusable workflows from the
sxzz/workflowsrepository for automated linting fixes, unit testing, and package releases. - [DYNAMIC_EXECUTION]: Includes a configuration script (
alias.ts) for monorepos that dynamically reads from and writes to thetsconfig.alias.jsonfile using Node.js filesystem APIs to synchronize path aliases. - [PERSISTENCE]: Sets up Git hooks through
simple-git-hooksto ensure automated code quality checks by runningeslint --fixduring the pre-commit stage. - [INDIRECT_PROMPT_INJECTION]: The skill provides templates for processing project-specific data through build and linting pipelines.
- Ingestion points: Reads project configuration files (e.g.,
tsconfig.alias.json) and project source code. - Boundary markers: Standard application boundaries for build and linting tools.
- Capability inventory: Includes filesystem read/write access via utility scripts and automated command execution through CI/CD workflows and Git hooks.
- Sanitization: Standard JSON parsing and stringification are used for configuration management.
Audit Metadata