package-info

Pass

Audited by Gen Agent Trust Hub on Jul 31, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • Variable Interpolation in Shell Commands: The skill provides instructions for executing shell commands (using yarn nx and grep) that incorporate user-supplied input via the $ARGUMENTS variable. This pattern presents a security consideration, as unvalidated input containing shell metacharacters could potentially lead to command injection. While this is within the context of a development tool, it is recommended that the executing agent escapes these arguments to prevent unintended command execution.- Repository Metadata Access: The skill is designed to read project configuration files such as package.json and CODEOWNERS. These operations are intended for the skill's primary purpose of providing package information, but users should be aware that the skill can access and summarize repository-level ownership and dependency data.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 31, 2026, 05:42 PM
Security Audit — agent-trust-hub — package-info