code-style

Warn

Audited by Gen Agent Trust Hub on May 13, 2026

Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs the agent to use a tool named tsgo provided by the package @typescript/native-preview for 'TypeScript 7 beta' typechecking.\n- Evidence: 'Typechecking runs under tsgo (TypeScript 7 beta, via @typescript/native-preview) — use tsgo -p tsconfig.json --noEmit in typecheck scripts'\n- Concern: TypeScript is currently at version 5.x. Referencing a non-existent major version (v7) and an unknown scoped package (@typescript/native-preview) is highly suspicious and could lead to the installation of malicious software through dependency confusion if an attacker registers that name.\n- [COMMAND_EXECUTION]: The skill contains instructions for the agent to execute shell commands using pnpm and the unverifiable tsgo tool.\n- Evidence: 'pnpm --filter @app/api format', 'tsgo -p tsconfig.json --noEmit'\n- Context: These commands are used for standard development tasks like formatting and typechecking, but their safety relies on the integrity of the referenced external packages.
Audit Metadata
Risk Level
MEDIUM
Analyzed
May 13, 2026, 05:51 PM