package-info
Pass
Audited by Gen Agent Trust Hub on Jul 31, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- Variable Interpolation in Shell Commands: The skill provides instructions for executing shell commands (using
yarn nxandgrep) that incorporate user-supplied input via the$ARGUMENTSvariable. This pattern presents a security consideration, as unvalidated input containing shell metacharacters could potentially lead to command injection. While this is within the context of a development tool, it is recommended that the executing agent escapes these arguments to prevent unintended command execution.- Repository Metadata Access: The skill is designed to read project configuration files such aspackage.jsonandCODEOWNERS. These operations are intended for the skill's primary purpose of providing package information, but users should be aware that the skill can access and summarize repository-level ownership and dependency data.
Audit Metadata