typescript-build-tools
Pass
Audited by Gen Agent Trust Hub on Aug 9, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill provides numerous code examples and instructions for executing standard development commands using package managers (Bun, pnpm), compilers (tsc), and task runners (Turbo). These are legitimate for the skill's purpose.
- [EXTERNAL_DOWNLOADS]: The skill references and downloads dependencies from the official npm registry and references documentation from well-known technology sites (biomejs.dev, turbo.build, oxc.rs). These are trusted sources according to standard development practices.
- [INDIRECT_PROMPT_INJECTION]: The skill instructions (SKILL.md) require the agent to read existing repository state (such as the presence of
bun.lock,pnpm-lock.yaml, orbiome.json) to determine tool selection. While this creates a data ingestion surface, it is a routine pattern for environment-aware development tools. - Ingestion points: File system checks for project lockfiles and configuration files.
- Boundary markers: Absent.
- Capability inventory: Shell execution for building and testing, and file system modification for package configuration.
- Sanitization: Absent.
Audit Metadata