tree-sitter-language-pack
Pass
Audited by Gen Agent Trust Hub on Aug 22, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill facilitates the download of parser libraries for 306 programming languages. These downloads are performed on-demand or via the
ts-pack downloadcommand, fetching resources from the author's official GitHub repository (xberg-io/tree-sitter-language-pack). - [REMOTE_CODE_EXECUTION]: The installation instructions include patterns for executing remote code from package registries, such as
npx @xberg-io/ts-pack-clianduvx --from ts-pack-cli ts-pack. These are standard methods for utilizing the vendor's CLI tools. - [COMMAND_EXECUTION]: The skill provides numerous shell commands for parsing, processing, and managing code intelligence, which are necessary for its documented functionality.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external source code files through the
parseandprocesscommands, representing an ingestion surface for potentially untrusted data. - Ingestion points: Files passed to
ts-pack parse <file>andts-pack process <file>in SKILL.md. - Boundary markers: None identified in the CLI output format.
- Capability inventory: The tool can read local files, execute shell commands, and download grammar files from the vendor's repository.
- Sanitization: Not explicitly defined for the parsed output, which is typical for a low-level parsing library.
Audit Metadata