auth-state-sync
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [SAFE]: The skill instructions provide standard web development patterns for cross-tab state management using built-in browser APIs. The described methods for distributed locking and silent refresh are established industry practices.
- [INDIRECT_PROMPT_INJECTION]: The skill implements logic to ingest and act upon data from storage and message channels.
- Ingestion points: Instructions in
SKILL.mdutilizewindow.addEventListener('storage')andBroadcastChannel.onmessageto receive external state updates. - Boundary markers: The logic restricts processing to specific expected keys (e.g.,
auth:logout) and message types (e.g.,LOGOUT). - Capability inventory: The logic can trigger page redirections, update in-memory variables, and clear storage state.
- Sanitization: The implementation uses
JSON.parse()for deserialization and relies on specific property checks before execution. - [EXTERNAL_DOWNLOADS]: The skill references the
jwt-decodelibrary in its code examples for client-side token validation. This is a standard and well-known library for processing JWT metadata.
Audit Metadata