skills/agentskillexchange/skills/publint Package Export Validation Skill for npm Release Checks/Gen Agent Trust Hub
publint Package Export Validation Skill for npm Release Checks
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external, potentially untrusted package data (manifests and file exports) to identify export issues, which creates a surface for indirect prompt injection attacks.
- Ingestion points: The skill ingests data from local package directories as specified in the usage instructions (e.g.,
./packages/my-library) inSKILL.md. - Boundary markers: There are no explicit instructions or delimiters defined to help the agent distinguish between tool output and potentially malicious instructions embedded within the files being analyzed.
- Capability inventory: The skill uses command execution via
npx publintand interprets the resulting output to provide explanations to the user. - Sanitization: There is no mention of sanitization, filtering, or escaping of the content found within the analyzed package files.
Audit Metadata