update-cnw-templates
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses shell commands to manage the development lifecycle of template repositories.
- Evidence: Execution of
git clone,npm install, andnx run-manyto build and test code. - Verification: The
run-all-templates.shscript executesnpx create-nx-workspaceto verify template integrity. - [DYNAMIC_EXECUTION]: The skill leverages dynamic code execution to perform migrations and scaffolding.
- Evidence: Runs
npx nx migrate --run-migrationswhich executes migration logic defined within the repositories. - Context: These operations are performed using the official Nx CLI and target the vendor's own verified repositories.
- [INDIRECT_PROMPT_INJECTION]: The skill processes content from external repositories and user inputs, creating a surface for indirect instructions.
- Ingestion points: Reads
package.jsonfrom cloned repositories and accepts a target version string from user input. - Boundary markers: No explicit boundary markers are used when interpolating file content into commands, though operations are scoped to the
tmp/cnw-templatesdirectory. - Capability inventory: Includes full bash execution, file system write access, and authenticated network operations (GitHub PR creation).
- Sanitization: The skill validates the target version using
npm view nx@<version> versionand checks repository availability via the GitHub API before processing.
Audit Metadata