nest-server-core-vendoring
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: No malicious patterns or security threats were detected. The skill focuses on legitimate software engineering workflows for vendored dependencies and synchronization between local and upstream sources.
- [EXTERNAL_DOWNLOADS]: The skill references and provides commands to compare local files with those from the vendor's official repository at github.com/lenneTech/nest-server. These are legitimate operations for the skill's purpose and utilize the author's own resources.
- [INDIRECT_PROMPT_INJECTION]: The skill's workflow involves reading project-local files and Git history to determine state, which represents a potential surface for indirect prompt injection. 1. Ingestion points: VENDOR.md, package.json, and Git commit logs. 2. Boundary markers: Absent. 3. Capability inventory: Git operations (cloning, diffing, patching), file system writes, and execution of local test suites via pnpm. 4. Sanitization: The instructions do not specify sanitization or validation of the content read from these local metadata sources.
Audit Metadata