shared-monorepo-nx

Pass

Audited by Gen Agent Trust Hub on Sep 20, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill references official plugins and tools from the @nx/ ecosystem and well-known services.
  • Evidence: References official plugins such as @nx/vite, @nx/react, and @nx/eslint in SKILL.md and examples/core.md.
  • Evidence: Utilizes official GitHub Actions like actions/checkout@v4 and actions/setup-node@v4 in examples/ci.md.
  • [REMOTE_CODE_EXECUTION]: The skill describes the use of nx migrate --run-migrations, which is a standard feature for updating monorepo dependencies and applying configuration changes.
  • Evidence: Documentation for updating the workspace in examples/generators.md uses the standard nx migrate command flow.
  • [DATA_EXFILTRATION]: The skill uses safe placeholders for sensitive tokens and standard practices for environment variable management.
  • Evidence: Uses secret placeholders like ${{ secrets.NX_CLOUD_ACCESS_TOKEN }} in examples/ci.md.
  • Evidence: Correctly identifies that .env files should be included in global inputs for cache invalidation without exposing their contents to external parties in examples/tasks.md.
  • [INDIRECT_PROMPT_INJECTION]: The skill operates on workspace configuration files (nx.json, project.json) which defines the execution surface of the build system.
  • Ingestion points: Configuration files like nx.json and project.json mentioned in SKILL.md.
  • Boundary markers: None; behavior is governed by the Nx task runner logic.
  • Capability inventory: The skill describes capabilities for task execution, file generation, and network access to Nx Cloud.
  • Sanitization: Relies on the standard Nx plugin architecture to safely parse and execute inferred tasks.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 20, 2026, 03:57 PM
Security Audit — agent-trust-hub — shared-monorepo-nx