typescript-code-review
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted TypeScript code and project configuration files (like
tsconfig.json) provided by users. This constitutes a standard surface for indirect prompt injection, where malicious instructions could be embedded in comments or code to influence the agent's behavior. - Ingestion points: User-provided TypeScript source files and configuration metadata (SKILL.md).
- Boundary markers: The instructions do not mandate the use of specific delimiters or 'ignore' instructions for the content being reviewed.
- Capability inventory: The skill involves reading local project files and searching through reference documentation using text-search tools.
- Sanitization: There is no explicit logic for sanitizing or filtering instructions that might be contained within the code being analyzed.
Audit Metadata