archiver
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill installs the 'archiver' package and its associated TypeScript definitions from the official NPM registry. These are well-known and widely used libraries for archive management in the Node.js ecosystem.
- [COMMAND_EXECUTION]: The setup instructions include standard package manager commands (npm install) to prepare the environment. These are expected for a library-based skill.
- [INDIRECT_PROMPT_INJECTION]: The skill accepts file paths and directory names as input to create archives. This represents a data ingestion surface where an attacker could theoretically attempt to include sensitive files in a bundle if the agent is not properly constrained. However, this functionality is the primary intended purpose of the skill, and the implementations use standard Node.js streaming APIs without custom logic that would facilitate exploitation.
Audit Metadata