typescript
Pass
Audited by Gen Agent Trust Hub on May 1, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill's instructions and references are entirely focused on legitimate software development practices and type system management.
- [PROMPT_INJECTION]: Instructions use authoritative language to define coding standards within the TypeScript domain. There are no attempts to bypass safety protocols, extract system prompts, or override agent behavior beyond the intended scope.
- [DATA_EXFILTRATION]: No network requests, hardcoded credentials, or access to sensitive local files (such as .env or SSH keys) are present. The skill strictly deals with code structure and type definitions.
- [EXTERNAL_DOWNLOADS]: The skill does not perform any remote script execution or package installations. References to 'TypeScript 7.0' and 'native Go compiler' are instructional concepts and do not point to untrusted remote sources.
- [PROMPT_INJECTION]: (Indirect Surface) The skill provides guidance for processing untrusted data.
- Ingestion points: Instructions in SKILL.md and references/narrowing.md discuss handling 'untrusted values', 'user input', and 'unknown' data types.
- Boundary markers: The skill explicitly mandates using 'unknown' and narrowing types before use, which acts as a logical boundary to prevent instruction leakage from data.
- Capability inventory: The skill is limited to providing coding patterns and configuration samples for standard TypeScript development environments.
- Sanitization: It strongly recommends runtime validation at trust boundaries, emphasizing that 'types do not validate data at runtime'.
Audit Metadata