cli-to-js-api-wrapper
Warn
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install the
cli-to-jspackage from NPM and run it vianpx. This involves downloading and executing code from an external source that is not verified or part of the trusted vendors list. - [COMMAND_EXECUTION]: The primary function of the skill is to spawn shell commands. The
convertCliToJsfunction executes the target binary with a--helpflag to introspect its interface, and the resulting API proxy executes subcommands with user-supplied flags and arguments. If the underlying library does not properly sanitize these inputs, it could lead to shell command injection. - [DYNAMIC_EXECUTION]: The tool uses a Proxy-based architecture to dynamically assemble and execute command strings at runtime based on method calls and object properties. This runtime generation of executable shell strings is a high-risk pattern if inputs are controlled by untrusted data.
Audit Metadata