performant-nodejs
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process and analyze external artifacts such as architecture documentation, source code, and design records, which represents an ingestion surface for untrusted content.
- Ingestion points: The ARCHITECTURE_REVIEW_TEMPLATE.md file explicitly mentions reviewing artifacts including architecture docs, codebases, Architecture Decision Records (ADRs), diagrams, and project specifications.
- Boundary markers: The instructions do not define specific delimiter-based markers to isolate external artifact content from the agent's core instructions, although general validation is encouraged.
- Capability inventory: The skill utilizes system analysis tools including node --inspect, npm audit, madge, and dependency-cruiser to evaluate the target system.
- Sanitization: The skill proactively mandates the use of schema-first validation (e.g., zod, ajv) and requires input validation before piping data to file systems or external sinks to prevent injection attacks.
- [SAFE]: The skill focuses on legitimate Node.js performance and architectural best practices with no evidence of malicious intent or unauthorized data access.
Audit Metadata