npx retrieves and executes third-party code absent from the audit materials
Source references: 2The examples directly execute `npx liarjs@0.3`. The npm package source is not included, so this review cannot verify that its implementation is limited to the documented scan. The zero-runtime-dependency claim does not prevent npx from obtaining and executing the package itself.
If the retrieved package, registry response, or selected release is compromised, code runs with the invoking user's permissions and may access files and processes available to that account.
The skill instructs the agent to run `npx liarjs@0.3`; if that version is absent locally, npx normally retrieves and executes the npm package. The supplied material contains documentation and a check list, but not the package implementation, so its behavior cannot be verified as limited to the described scan. “Zero runtime dependencies” does not establish trust in the package itself. A user can request auditable source, an exact pinned version with integrity verification, or restrict execution to an isolated environment.
```bashnpx liarjs@0.3 # launch a throwaway Chrome and scan itnpx liarjs@0.3 --all # also list the checks that passednpx liarjs@0.3 --offline # JS-layer checks only, no outbound requestnpx liarjs@0.3 --json scan.json # save the full result for later comparison```Show 1 other places
Requires Node 22 or newer and a local Chrome, Chromium or Edge. No other install step: the packagehas zero runtime dependencies.