typescript-security
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides legitimate security guidance for TypeScript applications, focusing on industry-standard libraries like Zod, Argon2id, and Helmet.
- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill correctly identifies that secrets should be stored in environment variables or secret managers and explicitly warns against committing them to version control. The mention of
.envfiles is documented as a secure practice for secret management. - [REMOTE_CODE_EXECUTION]: The instructions explicitly warn against dynamic execution (
eval,Functionconstructor) and command injection (string interpolation in shell commands), recommending safer alternatives likeexecFileSyncwith static commands and argument arrays. - [INDIRECT_PROMPT_INJECTION]: While the skill processes user-controlled input (as part of its intended purpose to provide validation advice), it provides clear boundaries and instructions on how to sanitize and validate this data to prevent attacks like XSS and SQL injection.
Audit Metadata