Find the type defects `tsc` is structurally unable to report — a green build is not evidence the types are correct. Covers the two classes: (1) hand-written types that restate an authoritative source and disagree with it, caught by substituting the derived type at a fixed commit and diffing `tsc` output; and (2) the standing blind spots in the language and config — unchecked array/record indexing, bivariant method parameters, covariant arrays, `any` absorption at untyped boundaries, precise signatures fed `any` at every call site, ambient `declare module` assertions that launder an `any` into a confident type, excess-property checks that only fire on fresh literals, and external data asserted rather than validated. Also audits typing edits that quietly change runtime behavior: stripped `| undefined`, deleted default parameters, literals swapped for runtime enum lookups, calls made optional so a throw becomes a silent no-op. Use when reviewing a JS→TS migration, a PR that hand-writes types for values that already have them, a "rename-only" refactor, or any PR claiming a change is mechanical. Triggers on /mms-tsc-blindspots, or on phrases like "validate this TypeScript migration", "is this type right", "does this type match the real shape", "why didn't CI catch this type", "derive vs define", and "what can tsc not check".
cp -r cryptoskill/skills/wallets/metamask-official-tsc-blindspots .claude/skills/clawhub install metamask-official-tsc-blindspotsCapabilities below are detected automatically by an open-source scanner that reads the skill's text and scripts (see how this is computed). Not measured means the scanner couldn't make a confident call — it is NOT a green check, and you should treat it as a possible red flag until a human or a stronger scanner has measured it.
unknown
We did not find any well-known hosted services in this skill's text or scripts. This does NOT mean the skill is local-only — it might use services we don't yet recognize, or talk to them through code paths our scanner can't reach. A complete dependency list (every package, library, and binary, with integrity hashes) is on the roadmap; today we only show recognized hosts.
No one has audited this skill yet. That is different from “audited and clean” — it just means no professional reviewer (a security firm, the CryptoSkill team, or a verified independent researcher) has signed off on it. There are no audit reports to read. How reviewer levels work →
SKILL.md → SOURCE.md → TRUST.auto.yaml → Browse directory →
Auto-generated by cryptoskill/extract-capabilities/0.3.1 · hosted-service list version 2026-09-06 · how this is computed