Typescript Eval

What the source does

• FilesystemNone observedNo reads or writes in the source
• NetworkNone observedNo outbound calls in the source
• ShellNone observedNo commands run in the source
• DependenciesPinnedNothing floats
• SecretsNone foundNo keys in source

Five audit layers

Gates applied: no behavioural pass.

assistant/CLAUDE.md

assistant/src/approvals/CLAUDE.md

assistant/src/notifications/CLAUDE.md

assistant/src/runtime/CLAUDE.md

gateway/CLAUDE.md

Audit 0.4.1 · source sha 19bc86343b63 · 14 Oct 2026Report an issue or request a re-scan

• Publishervellum-ai GitHub organizationOwner of the repository this skill is read from
• Source foldervellum-ai/vellum-assistant/skills/typescript-evalThe exact folder we audited
• LicenceMITAs the repository states it
• Commit pinned for this verdict19bc86343b63A new audit runs when the source changes
• Repository statusNot archivedLast push 1 day ago
• Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

Its description: Test TypeScript code snippets before persisting as skills

---
name: typescript-eval
description: Test TypeScript code snippets before persisting as skills
compatibility: "Designed for Vellum personal assistants"
metadata:
  emoji: "🧪"
  vellum:
    category: "development"
    display-name: "TypeScript Evaluation"
---

# TypeScript Evaluation

When you need to test a TypeScript snippet before persisting it as a managed skill, use `bash` directly.

## Workflow

### 1. Write the snippet to a temp file

```
bash command="mkdir -p /tmp/vellum-eval && cat > /tmp/vellum-eval/snippet.ts << 'SNIPPET_EOF'
<your code here>
SNIPPET_EOF"
```

### 2. Run it with bun

```
bash command="bun run /tmp/vellum-eval/snippet.ts" timeout_seconds=10
```

### 3. For function-based testing

If the snippet exports a `default` or `run` function, write a runner script:

```
bash command="cat > /tmp/vellum-eval/runner.ts << 'RUNNER_EOF'
import * as mod from './snippet.ts';
const fn = (mod as any).default ?? (mod as any).run;
const input = {}; // mock input
const result = await fn(input);
console.log(JSON.stringify(result, null, 2));
RUNNER_EOF"
```

Then run the runner:

```
bash command="bun run /tmp/vellum-eval/runner.ts" timeout_seconds=10
```

### 4. Clean up

```
bash command="rm -rf /tmp/vellum-eval/"
```

## Guidelines

- **Iteration limit:** Max 3 attempts before asking the user for guidance.
- **After successful test:** Persist with `scaffold_managed_skill` only after explicit user consent.
- **Timeout:** Use `timeout_seconds=10` (or up to 20 for complex snippets).
- **Never persist or delete skills without explicit user confirmation.**

Excerpt, first 1,586 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

git clone https://github.com/vellum-ai/vellum-assistant
git -C vellum-assistant checkout 19bc86343b63

Works in

1. 2026-10-14
   ✓SAFE B 89 / 100

   first audit · source 19bc86343b63

Questions about Typescript Eval

• github.com/vellum-ai/vellum-assistant/tree/main/skills/typescrip — the audited source at commit 19bc86343b63 and every finding aboveObserved · 14 Oct 2026

Spotted something wrong? Report a correction · Methodology