typescript-expert
Pass
Audited by Gen Agent Trust Hub on Mar 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes diagnostic commands such as
npx tsc --versionandnode -eto inspect project configuration and the tooling environment. - [EXTERNAL_DOWNLOADS]: The skill leverages
npxto run established utilities from the npm registry, includingvitest,biome, andeslint. - [REMOTE_CODE_EXECUTION]: The skill uses standard TypeScript runners (
tsx,ts-node) and reputable migration tools (ts-migrate) to facilitate development tasks. - [PROMPT_INJECTION]: The skill processes project configuration files (
package.json,tsconfig.json) and source code which serve as ingestion points for external data. The diagnostic logic uses secure JSON parsing and hardcoded command strings to handle this data safely. - Ingestion points:
package.json,tsconfig.json, and source files in thesrc/directory. - Boundary markers: No explicit delimiters are used for the data read from project files.
- Capability inventory: Execution of shell commands via
subprocess.run,npx, andnode -efor analysis and testing. - Sanitization: File content is parsed as structured JSON or processed using fixed command templates, preventing direct interpolation of untrusted content into shell execution paths.
Audit Metadata