tl-knip
Pass
Audited by Gen Agent Trust Hub on May 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill facilitates the execution of shell commands such as
npx knipfor project analysis andnpm uninstallfor dependency cleanup. It provides pre-written bash (knip-check.sh) and PowerShell (knip-check.ps1) scripts to automate these checks. These operations are essential to the skill's purpose of project maintenance. - [EXTERNAL_DOWNLOADS]: The skill utilizes
npxto download and run theknippackage from the official npm registry at runtime. It also references external resources for configuration schemas (unpkg.com) and official documentation (knip.dev), which are trusted and well-known sources in the JavaScript ecosystem. - [DATA_EXPOSURE]: To perform its analysis, the skill instructs the agent to read project metadata files (e.g.,
package.json,tsconfig.json) and scan the project's source code files. This is standard behavior for static analysis tools and does not involve accessing sensitive system credentials or exfiltrating data. - [SAFE]: The skill demonstrates an awareness of security and stability by providing specific 'Agent Cleanup Guidance' that distinguishes between safe 'auto-delete' actions and tasks that require user confirmation ('Ask before acting'). It also includes systematic troubleshooting documentation to handle potential false positives or configuration errors safely.
Audit Metadata