tl-knip

Pass

Audited by Gen Agent Trust Hub on May 1, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill facilitates the execution of shell commands such as npx knip for project analysis and npm uninstall for dependency cleanup. It provides pre-written bash (knip-check.sh) and PowerShell (knip-check.ps1) scripts to automate these checks. These operations are essential to the skill's purpose of project maintenance.
  • [EXTERNAL_DOWNLOADS]: The skill utilizes npx to download and run the knip package from the official npm registry at runtime. It also references external resources for configuration schemas (unpkg.com) and official documentation (knip.dev), which are trusted and well-known sources in the JavaScript ecosystem.
  • [DATA_EXPOSURE]: To perform its analysis, the skill instructs the agent to read project metadata files (e.g., package.json, tsconfig.json) and scan the project's source code files. This is standard behavior for static analysis tools and does not involve accessing sensitive system credentials or exfiltrating data.
  • [SAFE]: The skill demonstrates an awareness of security and stability by providing specific 'Agent Cleanup Guidance' that distinguishes between safe 'auto-delete' actions and tasks that require user confirmation ('Ask before acting'). It also includes systematic troubleshooting documentation to handle potential false positives or configuration errors safely.
Audit Metadata
Risk Level
SAFE
Analyzed
May 1, 2026, 02:02 PM