ariestools-sdk

Pass

Audited by Gen Agent Trust Hub on Oct 26, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill provides instructions for installing various packages within the @ariestools vendor scope (e.g., @ariestools/sdk, @ariestools/telemetry, @ariestools/express) as well as established third-party dependencies including zod, @opentelemetry/api, mongodb, ethers, cheerio, idb, and async-mutex.
  • [COMMAND_EXECUTION]: Documentation for maintainers includes commands for monorepo management such as pnpm xy build, pnpm xy test, and pnpm sync-sdk-layout to ensure repository consistency.
  • [INDIRECT_PROMPT_INJECTION]: The SDK includes robust HTTP utilities like fetchJson and FetchClient. While the documentation recommends security controls such as bounding response sizes (maxResponseBytes) and using abort signals, agents that use these tools to ingest data from untrusted URLs are exposed to potential indirect injection surfaces.
  • [SAFE]: The skill incorporates security best practices, such as advising developers to keep secrets/seeds out of logs when using the crypto-auth module and recommending the use of native Web Crypto APIs over deprecated polyfills.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 26, 2026, 04:09 PM