setup-ts-deep-modules
Pass
Audited by Gen Agent Trust Hub on Jul 27, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes repository metadata (lock files, package configurations) and project structure to configure environment-specific settings.
- Ingestion points: Processes
package.json,pnpm-lock.yaml,yarn.lock,bun.lockb, and the directory structure of the target repository inSKILL.mdStep 1. - Boundary markers: None present; the skill relies on standard shell execution patterns for the detected environment.
- Capability inventory: The skill possesses file system write access (creating
.dependency-cruiser.cjs,README.md, scaffold files), modification ofpackage.jsonscripts, and execution of package manager commands. - Sanitization: No specialized sanitization of repository file contents or structure is implemented before interpolation into commands.
- [EXTERNAL_DOWNLOADS]: The skill installs the
dependency-cruiserpackage using standard package managers (npm, pnpm, yarn, bun) as described inSKILL.mdStep 2. This is an expected operation for the skill's stated purpose. - [COMMAND_EXECUTION]: The skill executes shell commands to install dependencies and run the
depcruiselinter to verify the setup inSKILL.mdStep 6. These commands are necessary for the skill's functional requirements and are restricted to the local development environment.
Audit Metadata