Skill Trust Decision
typescript-package-manager
A documentation-reference skill for TypeScript package management that transparently discloses risks, defaults to read-only guidance, and requires explicit user approval for mutating actions — but documents dangerous curl|bash installer patterns that could be executed by an AI agent without adequate safeguards.
Why this conclusion was reached
1/4 dimensions flagged Pass
Declared vs actual capability
Declared resources and inferred behavior are broadly aligned.
Block
Hidden execution and egress
3 high-risk artifacts or egress signals were extracted.
Pass
Attack chain and severe findings
There is no explicit malicious chain in the report.
Review
Dependencies and supply chain hygiene
Dependency information is incomplete, so supply-chain confidence stays limited.
What drove the risk score up
curl|bash documented installer commands +10
SKILL.md prominently documents 'curl -fsSL https://bun.sh/install | bash' which executes remote code; mitigation is buried in prose and easy to skip in agent context
Undeclared shell:WRITE in helper scripts +5
bun-workflow.js.txt and health-check.js.txt use child_process.execSync for shell commands but the declared allowed-tools only mentions Read and Write
Read-only design with approval model is positive +-5
Skill explicitly requires user approval and diff review for mutating actions; skill-card.md lists all known risks with mitigations
No malicious behavior or credential theft +0
No evidence of data exfiltration, credential harvesting, obfuscation, or supply-chain attacks
.js.txt extension provides weak protection +5
Inert .js.txt naming is a soft guardrail; an AI agent could theoretically instruct a user to rename and run these without reading
Most important evidence
Medium RCE
curl|bash remote installer commands documented without strong safeguards
SKILL.md prominently features 'curl -fsSL https://bun.sh/install | bash' and 'curl -fsSL https://get.pnpm.io/install.sh | sh' as recommended installation methods. These commands download and execute arbitrary code from the network at execution time. While the Safety and Trust Model section warns about this, the warning is prose-only and easy to skip in an agent context. No version pinning is enforced for these installers.
SKILL.md:13 Replace curl|bash one-liners with version-pinned, downloaded installers or package-manager-based installs (npm install -g bun, corepack enable). Add a version pin to all installer URLs.
Low Doc Mismatch
Shell execution capability not declared in allowed-tools
The skill declares filesystem:READ but bun-workflow.js.txt:45 and health-check.js.txt:47 use child_process.execSync to run local shell commands (bun --version, node --version). While SKILL.md mentions 'shell out to local tools via child_process.execSync', this is not reflected in the declared capability map.
SKILL.md:309 Declare shell:READ capability if execSync is expected. Alternatively, document that execSync is informational only (version detection) and cannot be leveraged for arbitrary command execution.
Low Priv Escalation
.js.txt extension is a weak guardrail against script execution
Helper scripts ship with .js.txt extension so they are 'not directly executable'. While this prevents accidental double-click execution, an AI agent could instruct a user to rename bun-workflow.js.txt to bun-workflow.js and run it without reading, bypassing the safety intent. No cryptographic integrity check or hash verification exists.
SKILL.md:12 Add a SHA-256 hash of each helper script's expected content in SKILL.md so users (or an automated check) can verify the script has not been tampered with before renaming and running it.
Declared capability vs actual capability
Filesystem Pass
Declared READ
→ Inferred READ
SKILL.md states 'read-only guidance'; no filesystem:WRITE declared or observed in scripts Shell Pass
Declared NONE
→ Inferred READ
bun-workflow.js.txt:45 uses execSync('bun --version'); health-check.js.txt:47 uses execSync; SKILL.md line 309 mentions shell out to local tools but declared capabilities do not include shell Network Pass
Declared NONE
→ Inferred NONE
Documentation references URLs (bun.sh, pnpm.io) but no actual network calls; network access is described in docs for user context only Environment Pass
Declared NONE
→ Inferred NONE
No iteration through os.environ or environment variable access observed Skill Invoke Pass
Declared NONE
→ Inferred NONE
Skill does not invoke other skills Clipboard Pass
Declared NONE
→ Inferred NONE
No clipboard access observed Browser Pass
Declared NONE
→ Inferred NONE
No browser access observed Database Pass
Declared NONE
→ Inferred NONE
No database access observed Suspicious artifacts and egress
Critical Dangerous Command
curl -fsSL https://bun.sh/install | bash SKILL.md:13
Critical Dangerous Command
curl … | bash SKILL.md:309
Critical Dangerous Command
curl -fsSL https://get.pnpm.io/install.sh | sh scripts/pnpm-workflow.md:51
Medium External URL
https://bun.sh/install SKILL.md:13
Medium External URL
https://yourwebsite.com assets/package-json-template.md:25
Medium External URL
https://docs.npmjs.com/cli/v9/configuring-npm/package-json assets/package-json-template.md:521
Medium External URL
https://nodejs.org/api/packages.html assets/package-json-template.md:522
Medium External URL
https://www.typescriptlang.org/docs/handbook/module-resolution.html assets/package-json-template.md:523
Medium External URL
https://www.typescriptlang.org/docs/handbook/integrating-with-build-tools.html references/integration-with-build-tools.md:13
Medium External URL
https://vitejs.dev/guide/ references/integration-with-build-tools.md:614
Medium External URL
https://webpack.js.org/concepts/ references/integration-with-build-tools.md:615
Medium External URL
https://esbuild.github.io/ references/integration-with-build-tools.md:616
Dependencies and supply chain
There are no structured dependency warnings.
File composition
15 files · 6986 lines
Markdown 11 files · 5957 linesText 3 files · 1024 linesJSON 1 files · 5 lines
Files of concern · 9
scripts/health-check.md https://www.typescriptlang.org/tsconfig/ · https://www.typescriptlang.org/docs/handbook/declaration-files/do-s-and-don-ts.html
scripts/npm-workflow.md https://docs.npmjs.com/
scripts/yarn-workflow.md https://yarnpkg.com/ · https://yarnpkg.com/getting-started/migration · https://yarnpkg.com/features/pnp · https://yarnpkg.com/features/workspaces
scripts/bun-workflow.md https://bun.sh/docs · https://npm.mycompany.com/
scripts/bun-workflow.js.txt https://bun.sh/docs/runtime/bunfig · https://registry.myorg.com/
SKILL.md curl|bash remote installer commands documented without strong safeguards · Shell execution capability not declared in allowed-tools · .js.txt extension is a weak guardrail against script execution · curl -fsSL https://bun.sh/install | bash · curl … | bash · https://bun.sh/install
scripts/pnpm-workflow.md curl -fsSL https://get.pnpm.io/install.sh | sh · https://get.pnpm.io/install.ps1 · https://get.pnpm.io/install.sh · https://npm.company.com/ · https://pnpm.io/cli/add · https://pnpm.io/workspaces · https://pnpm.io/benchmarks
references/integration-with-build-tools.md https://www.typescriptlang.org/docs/handbook/integrating-with-build-tools.html · https://vitejs.dev/guide/ · https://webpack.js.org/concepts/ · https://esbuild.github.io/ · https://turbo.build/repo/docs
assets/package-json-template.md https://yourwebsite.com · https://docs.npmjs.com/cli/v9/configuring-npm/package-json · https://nodejs.org/api/packages.html · https://www.typescriptlang.org/docs/handbook/module-resolution.html
Other files · health-check.js.txt · npm-workflow.js.txt · package-manager-comparison.md
Security positives
skill-card.md explicitly lists all three known risks (helper scripts, remote installers, mutating commands) with specific mitigations — excellent transparency
SKILL.md enforces read-only guidance by default and requires explicit user approval plus diff review for all mutating actions
All .js.txt helper scripts are self-contained with no external npm dependencies, reducing supply-chain attack surface
No sensitive files accessed (~/.ssh, ~/.aws, .env, .npmrc with tokens) — no credential theft indicators found
No base64-encoded payloads, obfuscation, or reverse shell patterns detected across all files
No environment variable iteration for credential harvesting
Skill provenance is clear: author jhauga, version 1.0.2, MIT-0 license, ClawHub registry