loom-javascript
Pass
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill focuses on established best practices for secure and idiomatic JavaScript development.
- [COMMAND_EXECUTION]: The skill provides guidance on using
node:child_processand package manager tools. It correctly identifies security risks associated with shell execution and recommends using argument arrays withexecFileto prevent command injection (SKILL.md). - [INDIRECT_PROMPT_INJECTION]: The instructions acknowledge the attack surface of processing untrusted data (e.g., JSON parsing, CLI arguments) and proactively recommend defensive measures such as strict boundary validation and input sanitization (SKILL.md).
- [EXTERNAL_DOWNLOADS]: The skill references standard industry tools and packages (e.g.,
zod,vitest,eslint) for development and testing workflows. All referenced tools are well-known and standard in the ecosystem (SKILL.md).
Audit Metadata