pi-trending
Pass
Audited by Gen Agent Trust Hub on Jul 12, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill fetches package names and descriptions from the public npm registry and instructs the agent to translate and summarize them for the user. If an author includes malicious instructions in their npm package description, it could influence the agent's behavior during the translation or presentation phase.
- Ingestion points:
scripts/pi_trending.pyvia npm search API. - Boundary markers: None present in the instructions.
- Capability inventory: Data translation and summarization.
- Sanitization: No sanitization of the fetched description strings is performed before processing.
Audit Metadata