shared-monorepo-pnpm-workspaces
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill instructions strictly focus on monorepo management, dependency synchronization, and CI/CD optimization using standard pnpm features.
- [EXTERNAL_DOWNLOADS]: The skill references official GitHub Actions, including
pnpm/action-setup@v4andactions/setup-node@v4, which originate from trusted organizations and well-known services. - [COMMAND_EXECUTION]: Provides standard command-line instructions for
pnpm(e.g.,pnpm install,pnpm build,pnpm changeset), which are essential for the skill's primary purpose of managing a Node.js development environment. - [CREDENTIALS_UNSAFE]: References to
${NPM_TOKEN}and${GITHUB_TOKEN}in.npmrcand CI examples follow industry-standard secret management practices and do not contain hardcoded credentials. - [INDIRECT_PROMPT_INJECTION]: The skill defines patterns for processing project configuration files (
package.json,pnpm-workspace.yaml). While this presents a theoretical attack surface for indirect injection if a user-controlled project contained malicious metadata, the skill provides specific sanitization guidance such as utilizingallowBuildsto block unverified install scripts.
Audit Metadata