javascript-pro

Pass

Audited by Gen Agent Trust Hub on Apr 13, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: Provides detailed implementation patterns for Node.js process management using the child_process module, including spawn, exec, and execFile. These examples are intended for legitimate automation and backend tasks.\n- [EXTERNAL_DOWNLOADS]: Documents the use of the fetch API for making network requests and demonstrates loading modules from well-known external CDNs such as esm.sh within browser import maps.\n- [REMOTE_CODE_EXECUTION]: Explains standard ECMAScript features like dynamic import() for runtime module loading and code splitting, which are essential for modern web application performance.\n- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it documents methods for ingesting untrusted data via the file system (fs/promises), external APIs (fetch), and command-line arguments (process.argv). However, the risk is mitigated by the inclusion of basic input sanitization examples and the specific context of being a developer-oriented tool.\n- [DATA_EXFILTRATION]: Contains instructions for managing environment variables and communicating with remote servers. No malicious exfiltration chains or hardcoded credentials were found; all patterns align with standard professional development practices.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 13, 2026, 03:54 PM
Security Audit — agent-trust-hub — javascript-pro