syntax-text-handling
Pass
Audited by Gen Agent Trust Hub on Sep 1, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill consists entirely of technical documentation and code examples for working with the Biome compiler's syntax tree APIs. It does not include any executable scripts or configuration that performs actions outside of the provided text.
- [INDIRECT_PROMPT_INJECTION]: The skill provides instructions for processing external source code. While processing untrusted code constitutes an attack surface, the guidance explicitly recommends using typed syntax APIs (such as
SyntaxTokenandSyntaxNode) rather than raw string conversion or manual quote stripping. This structured approach is a security best practice that helps prevent the misinterpretation of data as instructions. - [DATA_EXPOSURE_AND_EXFILTRATION]: No sensitive file paths, hardcoded credentials, or network exfiltration patterns were detected. References to internal crate paths (e.g.,
crates/biome_rowan/src/token_text.rs) are consistent with the skill's stated purpose for the Biome repository. - [REMOTE_CODE_EXECUTION]: The skill does not define any external dependencies, package installations, or remote script download/execution patterns.
Audit Metadata