javascript-pro
Pass
Audited by Gen Agent Trust Hub on Apr 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: Provides detailed implementation patterns for Node.js process management using the
child_processmodule, includingspawn,exec, andexecFile. These examples are intended for legitimate automation and backend tasks.\n- [EXTERNAL_DOWNLOADS]: Documents the use of thefetchAPI for making network requests and demonstrates loading modules from well-known external CDNs such asesm.shwithin browser import maps.\n- [REMOTE_CODE_EXECUTION]: Explains standard ECMAScript features like dynamicimport()for runtime module loading and code splitting, which are essential for modern web application performance.\n- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it documents methods for ingesting untrusted data via the file system (fs/promises), external APIs (fetch), and command-line arguments (process.argv). However, the risk is mitigated by the inclusion of basic input sanitization examples and the specific context of being a developer-oriented tool.\n- [DATA_EXFILTRATION]: Contains instructions for managing environment variables and communicating with remote servers. No malicious exfiltration chains or hardcoded credentials were found; all patterns align with standard professional development practices.
Audit Metadata