rhdh-yarn-bump
Pass
Audited by Gen Agent Trust Hub on Aug 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The Node.js script
scripts/bump-yarn.jsusesspawnSyncto runyarn,git, andnodefor repository maintenance operations. - [REMOTE_CODE_EXECUTION]: The script dynamically loads and executes Yarn Berry release files (specifically
.cjsbinaries) located within the repository's.yarn/releasesfolder. - [EXTERNAL_DOWNLOADS]: The skill triggers
yarn set version, which may result in the automatic download and execution of official Yarn binaries from the Yarn registry. - [PRIVILEGE_ESCALATION]: The utility adjusts file permissions using
fs.chmodSyncto ensure Yarn release binaries have the necessary executable bits set.
Audit Metadata