typescript

Pass

Audited by Gen Agent Trust Hub on Oct 6, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes various TypeScript project files which could contain malicious instructions if the project files are from an untrusted source.
  • Ingestion points: Project configuration files such as package.json, tsconfig.json, biome.json, and pnpm-workspace.yaml are read to determine project state and runtime targets.
  • Boundary markers: Absent; the skill does not specify using delimiters or explicit warnings to ignore instructions embedded in the ingested data.
  • Capability inventory: The skill uses tools like pnpm, bash, tsc, and biome to write files and execute commands across the repository.
  • Sanitization: Absent; there is no evidence of sanitization for content read from the project configuration files.
  • [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using pnpm, tsc, biome, and other CLI tools like npm-check-updates and depcheck for project management and validation tasks.
  • [DYNAMIC_EXECUTION]: The skill generates and configures shell scripts for agent hooks located at .claude/hooks/ts.sh and .github/hooks/ts.sh. These scripts are executed by the agent platform to perform automated formatting and type-checking upon file edits.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 6, 2026, 08:52 PM