weekly-npm-dependency-audit
Pass
Audited by Gen Agent Trust Hub on Jul 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes
npm outdatedandnpm auditvia the shell to retrieve package status and security advisories from the local project environment. - [PROMPT_INJECTION]: The skill processes potentially untrusted external data, creating a surface for indirect prompt injection.
- Ingestion points: Reads content from
package.json,package-lock.json, and the stdout ofnpm outdatedandnpm auditcommands. - Boundary markers: Absent; the skill does not implement specific delimiters to isolate or ignore instructions embedded in the analyzed data.
- Capability inventory: Shell command execution (
npm). - Sanitization: Absent; the skill summarizes data directly from external tool outputs without filtering for malicious instruction patterns.
Audit Metadata