typo-checker
Pass
Audited by Gen Agent Trust Hub on Sep 27, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill recommends installing 'typos-cli' from multiple sources, including an official binary download from a well-known service (GitHub releases for 'crate-ci/typos').- [COMMAND_EXECUTION]: Executes the 'typos' binary along with standard shell utilities like 'sed', 'sort', 'uniq', and 'head' to scan, filter, and summarize spelling findings within the project directory.- [INDIRECT_PROMPT_INJECTION]: The skill processes codebase content that may contain untrusted data, creating a surface for indirect prompt injection.
- Ingestion points: The agent ingests data from the 'typos' command output, which includes file paths and text snippets containing identified spelling errors.
- Boundary markers: The instructions lack explicit delimiters or warnings to treat the tool's output as potentially adversarial data.
- Capability inventory: The agent has the capability to execute shell commands, read and write files (fixing typos, updating '_typos.toml'), and rename files.
- Sanitization: There is no mechanism described to sanitize or validate project content before it is presented to the agent for review and action.
Audit Metadata