publish-placeholder-package
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill performs several shell operations to manage the publication lifecycle.
- It uses
mktempto create an isolated workspace andnpm login/npm publishto interact with the package registry. - It executes
npm trustto configure GitHub Actions as a trusted publisher for the specified package. - [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection or command injection due to how it handles external input.
- Ingestion points: The skill accepts a package name and a repository package directory from the user or repo context as indicated in the workflow steps of
SKILL.md. - Boundary markers: There are no explicit delimiters or instructions provided to the agent to treat these inputs as untrusted data or to ignore embedded shell metacharacters.
- Capability inventory: The skill has significant capabilities, including the ability to execute shell commands (
npm,cat,mktemp,rm) and write files to the local file system. - Sanitization: There is no evidence of sanitization or validation logic to ensure the inputs do not contain malicious shell commands (e.g.,
pkg-name; curl ...).
Audit Metadata