dx-migrate-js-to-ts-sdk
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process user-provided JavaScript snippets and files for conversion. This creates a vulnerability surface where malicious instructions could be hidden within the source code to influence the agent's behavior during the rewrite process.
- Ingestion points: User-provided
javascript-snippetand files accessed via theReadtool. - Boundary markers: The skill instructions do not explicitly mandate the use of delimiters or instructions for the agent to ignore code-embedded commands.
- Capability inventory: The skill is permitted to use
Read,Grep, andGlobtools for file system inspection, but does not involve network operations or shell execution. - Sanitization: There are no specific instructions for sanitizing or validating the input code before the agent processes it.
- [EXTERNAL_DOWNLOADS]: The skill documentation recommends the installation of external Node.js packages to support the migration and functionality.
- Mentions the official packages:
@contentstack/delivery-sdk,@contentstack/persistance-plugin, and@contentstack/utils. - These resources are official libraries provided by the skill author.
Audit Metadata