shared-tooling-biome
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides documentation for Biome, a legitimate development tool. All commands and configuration examples follow industry best practices and refer to official sources for the @biomejs package and its ecosystem.\n- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to analyze project source code, which constitutes an ingestion point for potentially untrusted data. However, this behavior is fundamental to the skill's purpose as a linting tool.\n
- Ingestion points: User project source code files including JavaScript, TypeScript, JSON, CSS, and GraphQL files.\n
- Boundary markers: The skill does not specify particular delimiters for the code processed by the linter.\n
- Capability inventory: Use of npm for package installation and execution of the Biome CLI tool for code analysis and formatting.\n
- Sanitization: The skill relies on the standard operation of the Biome tool without additional input sanitization.
Audit Metadata