mastra
Pass
Audited by Gen Agent Trust Hub on Apr 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to perform local file system operations and package management tasks. These include using
ls,grep, andcatto search for documentation withinnode_modules/@mastra/, and running shell commands for project initialization (npm init,npm install,npm run dev). These are routine developer activities. - [EXTERNAL_DOWNLOADS]: The skill refers to official NPM packages (
@mastra/core,@mastra/memory, etc.) and recommends fetching documentation fromhttps://mastra.ai/llms.txt. These resources are consistent with the framework's own documentation and distribution channels. - [PROMPT_INJECTION]: The guide includes a strong instruction to the agent to prioritize current documentation over its internal training data ("Everything you know about Mastra is likely outdated or wrong. Never rely on memory."). While this uses patterns similar to system prompt overrides, it is scoped to technical API accuracy for a fast-moving framework and does not attempt to bypass safety filters.
Audit Metadata