shared-monorepo-pnpm-workspaces

Pass

Audited by Gen Agent Trust Hub on Sep 20, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill instructions strictly focus on monorepo management, dependency synchronization, and CI/CD optimization using standard pnpm features.
  • [EXTERNAL_DOWNLOADS]: The skill references official GitHub Actions, including pnpm/action-setup@v4 and actions/setup-node@v4, which originate from trusted organizations and well-known services.
  • [COMMAND_EXECUTION]: Provides standard command-line instructions for pnpm (e.g., pnpm install, pnpm build, pnpm changeset), which are essential for the skill's primary purpose of managing a Node.js development environment.
  • [CREDENTIALS_UNSAFE]: References to ${NPM_TOKEN} and ${GITHUB_TOKEN} in .npmrc and CI examples follow industry-standard secret management practices and do not contain hardcoded credentials.
  • [INDIRECT_PROMPT_INJECTION]: The skill defines patterns for processing project configuration files (package.json, pnpm-workspace.yaml). While this presents a theoretical attack surface for indirect injection if a user-controlled project contained malicious metadata, the skill provides specific sanitization guidance such as utilizing allowBuilds to block unverified install scripts.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 20, 2026, 03:57 PM
Security Audit — agent-trust-hub — shared-monorepo-pnpm-workspaces