javascript-sdk
Pass
Audited by Gen Agent Trust Hub on Feb 17, 2026
Risk Level: SAFE
Full Analysis
- [CREDENTIALS_SAFE] (SAFE): Documentation correctly identifies the risk of exposing API keys in client-side code and provides detailed instructions on implementing server-side proxies to mitigate this risk. Examples use environment variables and placeholders (e.g., 'inf_...') rather than real secrets.
- [DATA_EXPOSURE] (SAFE): File handling examples demonstrate reading and writing local files using standard Node.js APIs ('fs.readFileSync', 'fs.writeFileSync'). These are presented as educational examples for users building their own integrations and do not represent malicious exfiltration.
- [EXTERNAL_DOWNLOADS] (SAFE): The documentation references the official '@inferencesh/sdk' and other reputable third-party libraries such as '@upstash/ratelimit' and 'zod'.
- [COMMAND_EXECUTION] (SAFE): No evidence of arbitrary command execution or shell injection. Code snippets are restricted to SDK-specific functions and standard web/Node.js APIs.
- [INDIRECT_PROMPT_INJECTION] (SAFE): While the documentation describes how to ingest external data (file uploads, URL processing), it does so in a technical context for developers. It does not contain exploitable surfaces within the skill itself, as no executable logic is provided.
Audit Metadata