oxlint
Pass
Audited by Gen Agent Trust Hub on Oct 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute standard shell commands for package management (
npm install,brew install) and code analysis (npx oxlint). These operations are consistent with the skill's stated purpose of setting up a development environment. - [EXTERNAL_DOWNLOADS]: The skill references downloads for the oxlint binary and related NPM packages (
eslint-plugin-oxlint,lint-staged) from well-known official registries. It also references a GitHub Action from the official oxc-project repository. - [INDIRECT_PROMPT_INJECTION]: The skill processes project source code which represents an attack surface for indirect injection.
- Ingestion points: Local source code files are read and processed by the linter commands specified in the instructions.
- Boundary markers: None; the linter processes files directly within the project directory.
- Capability inventory: The skill uses shell execution capabilities to run linter checks and fix commands.
- Sanitization: No explicit sanitization is applied to the code being linted, which is typical for development tooling.
Audit Metadata