nx-generators
Fail
Audited by Gen Agent Trust Hub on Feb 16, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS] (HIGH): The skill provides instructions for the agent to install plugins via
pnpm nx add <plugin>. This pattern allows the installation of arbitrary software from the npm registry, which can include malicious packages that execute code during the installation process (lifecycle scripts).\n- [COMMAND_EXECUTION] (MEDIUM): The skill uses theBashtool to executepnpm nx g(generate) commands. These commands run code logic contained within the installed Nx plugins. If an untrusted plugin is added, the agent will execute potentially malicious code on the host system.
Recommendations
- AI detected serious security threats
Audit Metadata