melos-manager
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to generate and execute shell commands using the
melosCLI tool (e.g.,melos bootstrap,melos exec). This is the intended functionality for managing monorepos. - [EXTERNAL_DOWNLOADS]: The skill mentions installing the
melostool viadart pub global activate melosin CI environments.melosis a well-known, legitimate package in the Dart/Flutter community. - [INDIRECT_PROMPT_INJECTION]: The skill has the surface for indirect prompt injection as it analyzes user-provided
melos.yamlfiles. 1. Ingestion points: Analyzesmelos.yamland project directory structures provided by the user. 2. Boundary markers: None explicitly defined in the skill instructions. 3. Capability inventory: Suggests shell command execution for build, test, and release tasks. 4. Sanitization: Relies on standard agent behavior when interpreting configuration files.
Audit Metadata