typescript-build-references

Pass

Audited by Gen Agent Trust Hub on Nov 8, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • External tool utilization: The skill uses npx to run @monorepo-utils/workspaces-to-typescript-project-references. This allows for the automated verification of project references against workspace dependencies. While this involves running external code, it is a standard community tool used for the task's primary purpose.
  • Automated package installation: The skill instructions involve executing package manager commands like pnpm install or npm ci to establish a baseline environment. This ensures that verification steps are performed against correct project dependencies.
  • Native script execution: The skill verifies its work by running the repository's existing build and test scripts. This integration ensures that the new configuration remains compatible with the project's existing lifecycle commands.
  • Indirect prompt injection surface: The skill processes project configuration files and source code as input. To manage this surface, it identifies specific ingestion points (package and tsconfig files), utilizes compiler-based boundary markers (solution configs), and maintains a capability inventory including shell executions for build and test commands. Sanitization is achieved through formal compiler validation and linting rather than simple string processing.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 8, 2026, 05:32 PM