pnpm
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill serves as a documentation reference for the pnpm package manager and does not contain any executable scripts, obfuscated payloads, or malicious instructions.
- [SAFE]: All external links point to official pnpm documentation and reputable open-source repositories.
- [SAFE]: Configuration examples for CI/CD and authentication follow security best practices by using environment variable placeholders for sensitive tokens.
- [INDIRECT_PROMPT_INJECTION]: This skill documents tools for processing project-level configuration data. Ingestion points: Project configuration files including package.json, pnpm-workspace.yaml, .npmrc, and .pnpmfile.cjs. Boundary markers: The documentation recommends using --frozen-lockfile to ensure input integrity. Capability inventory: Supports command execution (pnpm run), binary execution (pnpm exec), and remote package execution (pnpm dlx). Sanitization: pnpm provides native mechanisms to skip lifecycle scripts (--ignore-scripts) and verify package integrity via lockfiles.
Audit Metadata