setup-mateonunez-skills
Pass
Audited by Gen Agent Trust Hub on May 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes
corepack prepare pnpm@latest --activateandpnpm installas part of the scaffolding process. These are standard commands for setting up a Node.js development environment and are consistent with the skill's stated purpose of wiring up repository conventions. - [EXTERNAL_DOWNLOADS]: The skill triggers the download of the pnpm package manager and project dependencies from official registries via corepack and pnpm. These downloads target well-known package management services.
- [PROMPT_INJECTION]: The skill reads repository configuration files (such as
package.jsonandbiome.json) to detect existing setups. While this represents an untrusted data ingestion surface, the skill includes explicit checkpoints to surface findings and request user confirmation before performing any modifications or migrations.
Audit Metadata