code-style
Warn
Audited by Gen Agent Trust Hub on May 13, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to use a tool named
tsgoprovided by the package@typescript/native-previewfor 'TypeScript 7 beta' typechecking.\n- Evidence: 'Typechecking runs undertsgo(TypeScript 7 beta, via@typescript/native-preview) — usetsgo -p tsconfig.json --noEmitintypecheckscripts'\n- Concern: TypeScript is currently at version 5.x. Referencing a non-existent major version (v7) and an unknown scoped package (@typescript/native-preview) is highly suspicious and could lead to the installation of malicious software through dependency confusion if an attacker registers that name.\n- [COMMAND_EXECUTION]: The skill contains instructions for the agent to execute shell commands using pnpm and the unverifiable tsgo tool.\n- Evidence: 'pnpm --filter @app/api format', 'tsgo -p tsconfig.json --noEmit'\n- Context: These commands are used for standard development tasks like formatting and typechecking, but their safety relies on the integrity of the referenced external packages.
Audit Metadata