cg-test-skill
Security checks across static analysis, malware telemetry, and agentic risk
Overview
This is an instruction-only pnpm helper with no code or install steps, but users should still review pnpm commands because they can change dependencies and may read npm configuration.
This skill appears safe as an instruction-only pnpm reference. Before installing, be aware that pnpm tasks can change dependency files and run package code, and avoid revealing any tokens that may be present in .npmrc.
Static analysis
No static analysis findings were reported for this release.
VirusTotal
VirusTotal findings are pending for this skill version.
Risk analysis
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
If approved carelessly, pnpm commands could change package.json, lockfiles, installed dependencies, or run project/package code.
These pnpm operations can modify dependency files or execute package scripts, but they are explicitly tied to the package-manager purpose.
CLI Commands | Install, add, remove, update, run, exec, dlx, and workspace commands
Review dependency-changing or execution commands before allowing them, especially run, exec, and dlx.
The agent may inspect project configuration that could include npm registry credentials if those are stored in .npmrc.
.npmrc is a normal pnpm/npm configuration file, but it can also contain registry authentication tokens or private registry settings.
agents should check for `pnpm-workspace.yaml` and `.npmrc` files to understand workspace structure and configuration
Avoid exposing .npmrc contents in chat or logs; redact tokens and only allow access to the project configuration needed for the task.
Users cannot verify provenance from registry metadata alone, although no executable code or install step is included.
The registry metadata does not provide a verified source or homepage, even though the SKILL.md claims the content was generated from pnpm-related repositories.
Source: unknown; Homepage: none
Treat the skill as documentation guidance and verify pnpm behavior against official pnpm documentation when making important dependency changes.