tsdown
Fail
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: CRITICALEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONNO_CODE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions for installing
tsdownand related packages via standard package managers (pnpm,npm,npx). It also documents an experimental feature (exe) that facilitates the download of official Node.js binaries fromnodejs.orgto generate standalone executables. - [COMMAND_EXECUTION]: The documentation includes extensive references for CLI commands (
tsdown,tsdown-migrate) and provides examples of programmatic integration using Node.jschild_processmodules (execSync,spawn) for build automation. - [NO_CODE]: The skill contains only Markdown documentation and configuration references. No executable scripts (.js, .py, .sh) are included in the skill distribution itself.
- [SAFE]: Thorough analysis of the 42 files, including those flagged by automated scanners, revealed no evidence of malicious patterns, obfuscation, prompt injection, or data exfiltration. The automated scan findings are likely false positives triggered by the technical nature of the documentation, which includes numerous shell command examples and links to development tools.
Recommendations
- CRITICAL: 3 file(s) identified as malware by FileRep - DO NOT USE
Audit Metadata