TypeScript Config Generator

Security checks across static analysis, malware telemetry, and agentic risk

Overview

This skill is a simple TypeScript config generator, with only minor user-notice items around overwriting tsconfig.json and user-directed setup commands.

This appears safe for its stated purpose. Before using it, make sure you are in the correct project folder and understand that it may overwrite tsconfig.json; review the npm/tsc setup commands before running them globally.

Static analysis

No static analysis findings were reported for this release.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Risk analysis

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

#
ASI02: Tool Misuse and Exploitation
Low
What this means

Running the skill could replace an existing TypeScript configuration for the current project.

Why it was flagged

The script writes directly to tsconfig.json in the current directory. This is aligned with a TypeScript config generator, but it may overwrite an existing project config if run in the wrong location.

Skill content
cat > tsconfig.json << JSON
Recommendation

Run it only in the intended project directory and back up or review any existing tsconfig.json first.

#
ASI04: Agentic Supply Chain Vulnerabilities
Info
What this means

Following the setup instructions may modify the user's global npm environment or initialize files in the current project.

Why it was flagged

The skill documents a global npm package install and a TypeScript initialization command. These are normal for TypeScript setup, but they are user-directed environment changes rather than a declared install spec.

Skill content
npm install -g typescript
tsc --init
Recommendation

Review the setup commands before running them, and prefer a project-local TypeScript install if that better fits the project.