modernize-ecmascript
Pass
Audited by Gen Agent Trust Hub on Sep 1, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches an index of ECMAScript proposals and technical metadata from
https://bosens-china.github.io/tc39-atlas/llms.txt. This information is used to guide the agent in determining which modern language features are compatible with the current project's build chain.- [INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted data from external sources (such as TC39 proposal descriptions and project-specific configuration files) which could influence the agent's code modification and command execution behavior. - Ingestion points: Fetches data from external URLs (TC39 Atlas) and reads local project files (
package.json, build configs). - Boundary markers: The skill lacks explicit delimiters for external content but instructs the agent to verify implementation status against official repositories.
- Capability inventory: The agent is authorized to modify source code and execute project commands (e.g., build, test, lint) based on the analysis of these external inputs.
- Sanitization: The instructions mandate user confirmation for significant changes like adding new dependencies, polyfills, or changing build targets.
Audit Metadata