bump-shared-dependencies
Pass
Audited by Gen Agent Trust Hub on Jun 22, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads Javascript modules from esm.sh, which is a well-known service for hosting NPM packages as ES modules. This is a legitimate operation for a skill designed to mirror dependencies.
- [REMOTE_CODE_EXECUTION]: Automated alerts identified a curl command piped to grep as potential RCE. Analysis confirms this is a false positive; the command extracts version strings (e.g., 19.2.6) from file comments and does not execute any downloaded code.
- [COMMAND_EXECUTION]: Uses standard shell utilities like curl, mkdir, ls, and grep to perform file management and version checks. All commands are relevant to the stated task.
- [DATA_EXFILTRATION]: Network activity is restricted to public assets from esm.sh and references to the vendor's own cdn.nav.no domain. No access to sensitive credentials, environment variables, or private data was detected.
Audit Metadata