typescript-update

Pass

Audited by Gen Agent Trust Hub on Nov 5, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • Command Execution: The skill is designed to run the project's own build, typecheck, test, and lint scripts. This is used to establish a baseline of the project's health and to verify that the upgrade hasn't introduced regressions. While this involves executing arbitrary local code, it is a necessary part of the software development lifecycle for dependency management.
  • External Resource Installation: The upgrade workflow involves the installation of specific versions of the TypeScript compiler (e.g., typescript@7) and auxiliary compatibility packages such as @typescript/typescript6 and @typescript/native. It also utilizes migration utilities like @andrewbranch/ts5to6 to automate configuration updates. These resources are standard components within the TypeScript ecosystem.
  • Indirect Prompt Injection Surface: The skill evaluates the project's state by reading its configuration and source files, which creates a potential surface for indirect influence.
  • Ingestion points: The agent reads package.json, tsconfig.json, lockfiles, and project source files (scanned via git grep) to understand the environment.
  • Boundary markers: There are no explicit delimiters or instructions provided to separate the content of these files from the agent's internal logic.
  • Capability inventory: The skill possesses the capability to execute shell commands via various package managers (npm, yarn, pnpm), modify configuration files, and install external dependencies.
  • Sanitization: The skill does not explicitly describe a process for sanitizing the contents of project-defined scripts or configuration values before they are used in execution strings.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 5, 2026, 09:53 PM