source-driven
Pass
Audited by Gen Agent Trust Hub on Jun 18, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill employs dynamic context injection using the
!commandsyntax to executecat package.jsonwhen the skill is initialized. This automatically populates the agent's context with the project's dependency list. This is a legitimate use of the platform's features for project-specific tooling. - [DATA_EXPOSURE]: The workflow instructs the agent to read local project files, including
package.jsonand source files within thenode_modules/directory. This access is limited to project structure and library definitions required for the skill's stated purpose. - [EXTERNAL_DOWNLOADS]: The skill leverages the
WebFetchtool to retrieve external documentation. The instructions emphasize fetching specific versioned documentation rather than 'latest' to avoid hallucinations and ensure code compatibility.
Audit Metadata