typescript-pro
Fail
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: CRITICALEXTERNAL_DOWNLOADSMETADATA_POISONINGINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Multiple security scanners have identified confirmed threats associated with this skill. The documentation URL (https://jeffallan.github.io/claude-skills/skills/language/typescript-pro/) is blacklisted as malicious by URL reputation services. Furthermore, the file SKILL.md itself has been flagged by file reputation scanners as containing malware.
- [METADATA_POISONING]: There is a significant discrepancy between the author identified in the skill's YAML frontmatter (Jeffallan) and the author account reported by the platform (harshsinghmp). This mismatch can be used to obfuscate the skill's true origin or leverage the reputation of another developer.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to analyze and process external TypeScript code and configuration data, creating a surface for indirect prompt injection attacks.
- Ingestion points: The agent is instructed to ingest and analyze user-provided TypeScript source code and build configuration files (tsconfig.json) to perform type-safety checks.
- Boundary markers: The instructions do not implement delimiters or safety warnings to ensure the agent ignores instructions embedded within the processed source code.
- Capability inventory: The skill uses standard development tools (tsc, type-coverage, @typescript/analyze-trace) for analysis but does not contain logic for network exfiltration or unauthorized file system writes.
- Sanitization: The skill does not include any steps to sanitize or validate the content of the ingested code files before processing.
Recommendations
- CRITICAL: 1 file(s) identified as malware by FileRep - DO NOT USE
- AI detected serious security threats
- Contains 2 malicious URL(s) - DO NOT USE
Audit Metadata