ariestools-sdk
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions for installing various packages within the
@ariestoolsvendor scope (e.g.,@ariestools/sdk,@ariestools/telemetry,@ariestools/express) as well as established third-party dependencies includingzod,@opentelemetry/api,mongodb,ethers,cheerio,idb, andasync-mutex. - [COMMAND_EXECUTION]: Documentation for maintainers includes commands for monorepo management such as
pnpm xy build,pnpm xy test, andpnpm sync-sdk-layoutto ensure repository consistency. - [INDIRECT_PROMPT_INJECTION]: The SDK includes robust HTTP utilities like
fetchJsonandFetchClient. While the documentation recommends security controls such as bounding response sizes (maxResponseBytes) and using abort signals, agents that use these tools to ingest data from untrusted URLs are exposed to potential indirect injection surfaces. - [SAFE]: The skill incorporates security best practices, such as advising developers to keep secrets/seeds out of logs when using the
crypto-authmodule and recommending the use of native Web Crypto APIs over deprecated polyfills.
Audit Metadata