slice-closeout
Warn
Audited by Gen Agent Trust Hub on Nov 11, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [DYNAMIC_EXECUTION]: The script
scripts/lib/adapter-typescript.mjsdynamically loads thetypescriptmodule usingcreateRequirefrom paths computed at runtime. It searches through localnode_modulesand.pnpmstores to locate a compatible version. Similarly,scripts/lib/stryker.mjsdynamically resolves and interacts with thevitestbinary based on the project's local environment. - [COMMAND_EXECUTION]: The skill frequently executes shell commands to perform its tasks.
scripts/lib/core.mjsexecutesgitfor diffing and history analysis. Most significantly,scripts/lib/stryker.mjsimplements asandboxBuildfunction that utilizesspawnSyncwithshell: trueto execute project-specific build commands provided via the--build-commandargument. This represents a significant attack surface if an agent is directed to operate on a malicious repository containing dangerous build instructions. - [EXTERNAL_DOWNLOADS]: The
SKILL.mdinstructions guide the agent to perform a local dependency installation usingnpm ci --prefix <scripts_directory>. This downloads external packages defined inscripts/package.json, which includes the Stryker mutator core and Vitest runner.
Audit Metadata