javascript

Pass

Audited by Gen Agent Trust Hub on May 4, 2026

Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
  • [SAFE]: The skill is a legitimate technical resource for senior JavaScript developers, covering ES2023+ syntax, asynchronous patterns, and platform-specific APIs.
  • Evidence: The content across all reference files consists of standard documentation, best practices, and code snippets for common development tasks.
  • [COMMAND_EXECUTION]: The skill provides documentation for executing system commands and managing child processes in Node.js.
  • Evidence: references/node-essentials.md contains examples of child_process.exec for shell command execution and child_process.spawn for process management.
  • [DATA_EXFILTRATION]: The reference guide covers standard I/O operations and network requests which are fundamental to JavaScript development.
  • Evidence: references/browser-apis.md and references/async-patterns.md demonstrate the use of the fetch API for network communication, while references/node-essentials.md details file system access using fs/promises.
  • [PROMPT_INJECTION]: The skill presents a surface for indirect prompt injection by demonstrating data ingestion from external sources without explicitly requiring sanitization.
  • Ingestion points: fetch() operations in references/async-patterns.md and references/browser-apis.md, and readFile() in references/node-essentials.md.
  • Boundary markers: Absent in provided code examples.
  • Capability inventory: The skill includes documentation for child_process.exec, fs.writeFile, and network operations across multiple reference files.
  • Sanitization: Instructions for sanitizing or escaping external content before processing are not explicitly provided in the examples.
Audit Metadata
Risk Level
SAFE
Analyzed
May 4, 2026, 03:37 PM
Security Audit — agent-trust-hub — javascript