best-practices
Pass
Audited by Gen Agent Trust Hub on Mar 15, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: No instructions were found that attempt to override agent safety filters or system prompts.
- [DATA_EXFILTRATION]: No patterns for accessing sensitive files like SSH keys or environment variables were detected.
- [EXTERNAL_DOWNLOADS]: Code examples reference well-known services such as polyfill.io and trusted-cdn.com for illustrative purposes.
- [COMMAND_EXECUTION]: Provides examples of legitimate development commands such as npm audit and npm update for security maintenance.
- [CREDENTIALS_UNSAFE]: No hardcoded credentials or secrets were found; only generic placeholders like 'abc123' are used in examples.
- [SAFE]: The skill presents an indirect prompt injection surface as it is intended to audit user-provided code. Ingestion points: User-supplied web code (SKILL.md). Boundary markers: Absent. Capability inventory: No executable scripts or filesystem write access within the skill itself. Sanitization: The skill correctly recommends the use of libraries like DOMPurify for sanitizing untrusted HTML in web applications.
Audit Metadata