nodeops-auth
Pass
Audited by Gen Agent Trust Hub on Apr 8, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill installs the
@nodeops-createos/integration-oauthpackage via standard package managers. This dependency is a vendor-owned resource that aligns with the author's identity and the skill's primary function of providing NodeOps authentication. - [COMMAND_EXECUTION]: The skill executes standard package manager commands (npm, pnpm, yarn) to install the necessary integration libraries and set up the project environment.
- [SAFE]: The skill implements proper secret management by instructing the agent to create or update a
.gitignorefile to include.env.local. This prevents the exposure of sensitive credentials such as theNODEOPS_CLIENT_SECRET. - [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface (Category 8) as it reads and modifies user project files. Ingestion points: Reads project metadata and source code from
package.json,tsconfig.json, and root layout files (SKILL.md). Boundary markers: No explicit delimiters or warnings to ignore embedded instructions are present. Capability inventory: Includes package installation and file-writing capabilities across the installation and setup steps. Sanitization: No explicit validation or sanitization of the content read from the project files is performed.
Audit Metadata