Typescript Pro

• Outcome: Pass
• Latest audit: May 27, 2026, 9:42 PM
• Version:
  0.1.0

Overview

This is an instruction-only TypeScript guidance skill with no evidence of hidden execution, data theft, persistence, or destructive behavior.

Safe to install as a TypeScript coding-assistance skill. Review generated tsconfig changes and any code that touches environment variables before applying it to a real project, especially when secrets are involved.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The manifest trigger phrases include generic terms such as "TypeScript," "generics," and "type safety," which are common in ordinary development discussions and not clearly bounded to when this specific skill should activate. The file does not provide exclusion conditions or negative examples to clarify when these terms should not invoke the skill.

Missing User Warnings

Low

• Confidence: 77% confidence
• Finding: This markdown file contains code that reads `process.env.API_URL` and `process.env.API_KEY`, which falls under access to sensitive environment variables. The snippet includes no warning, disclosure, or cautionary note about credential sensitivity or safe handling, and the surrounding markdown does not mention that the example touches environment-based secrets.

VirusTotal

65/65 vendors flagged this skill as clean.