typescript-update
Pass
Audited by Gen Agent Trust Hub on Nov 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- Command Execution: The skill is designed to run the project's own
build,typecheck,test, andlintscripts. This is used to establish a baseline of the project's health and to verify that the upgrade hasn't introduced regressions. While this involves executing arbitrary local code, it is a necessary part of the software development lifecycle for dependency management. - External Resource Installation: The upgrade workflow involves the installation of specific versions of the TypeScript compiler (e.g.,
typescript@7) and auxiliary compatibility packages such as@typescript/typescript6and@typescript/native. It also utilizes migration utilities like@andrewbranch/ts5to6to automate configuration updates. These resources are standard components within the TypeScript ecosystem. - Indirect Prompt Injection Surface: The skill evaluates the project's state by reading its configuration and source files, which creates a potential surface for indirect influence.
- Ingestion points: The agent reads
package.json,tsconfig.json, lockfiles, and project source files (scanned viagit grep) to understand the environment. - Boundary markers: There are no explicit delimiters or instructions provided to separate the content of these files from the agent's internal logic.
- Capability inventory: The skill possesses the capability to execute shell commands via various package managers (
npm,yarn,pnpm), modify configuration files, and install external dependencies. - Sanitization: The skill does not explicitly describe a process for sanitizing the contents of project-defined scripts or configuration values before they are used in execution strings.
Audit Metadata