typescript-build-references
Pass
Audited by Gen Agent Trust Hub on Nov 8, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- External tool utilization: The skill uses
npxto run@monorepo-utils/workspaces-to-typescript-project-references. This allows for the automated verification of project references against workspace dependencies. While this involves running external code, it is a standard community tool used for the task's primary purpose. - Automated package installation: The skill instructions involve executing package manager commands like
pnpm installornpm cito establish a baseline environment. This ensures that verification steps are performed against correct project dependencies. - Native script execution: The skill verifies its work by running the repository's existing
buildandtestscripts. This integration ensures that the new configuration remains compatible with the project's existing lifecycle commands. - Indirect prompt injection surface: The skill processes project configuration files and source code as input. To manage this surface, it identifies specific ingestion points (package and tsconfig files), utilizes compiler-based boundary markers (solution configs), and maintains a capability inventory including shell executions for build and test commands. Sanitization is achieved through formal compiler validation and linting rather than simple string processing.
Audit Metadata