Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent TypeScript helper skill; the flagged items are tutorial examples and normal TypeScript setup commands, not hidden or malicious behavior.
Install only if you want a TypeScript coding and migration reference skill. When using its setup commands, prefer pinned package versions and local project scripts, and review any proposed package.json, tsconfig, or file-renaming changes before applying them.
Referenced artifact was not completely inspected
- **[types.md](references/types.md)** - Advanced types, conditional types, mapped types, type guards, and recursive types
Referenced artifact was not completely inspected
- **[classes.md](references/classes.md)** - Class syntax, inheritance, generics, and utility types
Referenced artifact was not completely inspected
- **[miscellaneous.md](references/miscellaneous.md)** - Async programming, promises, decorators, and JSDoc integration
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
payment.processPaymentV2(100, 'USD'); // No warning
The skill instructs users to run npx tsc, which may fetch and execute a package if TypeScript is not already installed locally. Because no version is pinned, execution can become non-reproducible and could expose users to supply-chain risk if an unexpected or malicious package version is resolved.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
async function fetchUserData() {
try {
const response = await fetchWithTimeout(
fetch('https://api.example.com/user/1'),
3000 // 3 second timeout
);
const data = await response.json();
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
async function fetchUserData() {
try {
const response = await fetchWithTimeout(
fetch('https://api.example.com/user/1'),
3000 // 3 second timeout
);
const data = await response.json();
No suspicious patterns detected.