Skills
skills/nevaberry/nevaberry-plugins/typescript-knowledge-patch/Gen Agent Trust Hub

typescript-knowledge-patch

Warn

Audited by Gen Agent Trust Hub on Apr 7, 2026

Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill recommends installing unverified and non-standard packages such as @typescript/native-preview, tsgo, and ts5to6. These packages are not part of the official TypeScript project and could be used to deliver malicious payloads through the npm registry.
  • [COMMAND_EXECUTION]: The instructions include running npx commands (npx tsgo, npx ts5to6) that download and execute code from remote sources without integrity verification. These commands are linked to deceptive technical claims about future software releases.
  • [METADATA_POISONING]: The skill contains fabricated documentation regarding future TypeScript versions (5.9 through 7.0), including claims of a Go-based rewrite. This deceptive content is designed to override the agent's baseline knowledge and persuade users to adopt unauthorized tools.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Apr 7, 2026, 02:34 AM