performant-nodejs

Pass

Audited by Gen Agent Trust Hub on Oct 14, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to process and analyze external artifacts such as architecture documentation, source code, and design records, which represents an ingestion surface for untrusted content.
  • Ingestion points: The ARCHITECTURE_REVIEW_TEMPLATE.md file explicitly mentions reviewing artifacts including architecture docs, codebases, Architecture Decision Records (ADRs), diagrams, and project specifications.
  • Boundary markers: The instructions do not define specific delimiter-based markers to isolate external artifact content from the agent's core instructions, although general validation is encouraged.
  • Capability inventory: The skill utilizes system analysis tools including node --inspect, npm audit, madge, and dependency-cruiser to evaluate the target system.
  • Sanitization: The skill proactively mandates the use of schema-first validation (e.g., zod, ajv) and requires input validation before piping data to file systems or external sinks to prevent injection attacks.
  • [SAFE]: The skill focuses on legitimate Node.js performance and architectural best practices with no evidence of malicious intent or unauthorized data access.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 14, 2026, 02:44 PM