setup-eslint
Pass
Audited by Gen Agent Trust Hub on Mar 20, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads 'eslint' and the '@zhangyu1818/eslint-config' package from the public npm registry using detected package managers such as npm, pnpm, yarn, or bun.\n- [COMMAND_EXECUTION]: Executes shell commands to install dependencies and run the linter (e.g., 'npm install', 'pnpm exec eslint .') to verify that the configuration is working correctly.\n- [PROMPT_INJECTION]: Indirect surface detected where the skill reads and processes project files like 'package.json' and lockfiles to automatically determine which linting presets to enable.\n
- Ingestion points: 'package.json', 'pnpm-lock.yaml', 'yarn.lock', 'bun.lockb', 'package-lock.json'.\n
- Boundary markers: None; the skill assumes the project's configuration files are valid and follows the instructions derived from their content.\n
- Capability inventory: Includes writing configuration files to the local filesystem and executing shell commands via the package manager.\n
- Sanitization: No sanitization is performed on the data extracted from configuration files before it is used to select presets or run commands.
Audit Metadata