javascript-pro

Pass

Audited by Gen Agent Trust Hub on Sep 22, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external JavaScript files (.js, .mjs, .cjs), which serves as an ingestion point for untrusted data. While there are no explicit boundary markers or sanitization steps mentioned, this is a standard characteristic of code-analysis skills.
  • Ingestion points: The skill is triggered to review and refactor user-provided JavaScript source files.
  • Boundary markers: None specified.
  • Capability inventory: Includes shell execution for linting (eslint), testing (jest), and debugging (node --inspect).
  • Sanitization: None specified.
  • [COMMAND_EXECUTION]: The workflow involves executing standard developer CLI tools (ESLint and Jest) to validate code quality and correctness. These operations are performed within the expected scope of a software development skill.
  • [EXTERNAL_DOWNLOADS]: The reference material includes a link to https://esm.sh/react@18 within a browser import map example. This targets a well-known and reputable CDN for JavaScript modules and is used in a standard educational context.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 22, 2026, 11:04 PM