setup-browser-sdk-sourcemaps
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of official Datadog build plugins (@datadog/vite-plugin, @datadog/webpack-plugin, @datadog/rollup-plugin, @datadog/rspack-plugin, @datadog/esbuild-plugin) using standard Node.js package managers (npm, yarn, pnpm, bun). These packages are official vendor resources provided by the skill's author.
- [INDIRECT_PROMPT_INJECTION]: The skill analyzes repository content to generate configuration settings, creating an attack surface for data processed from the local environment.
- Ingestion points: Reads project configuration files (vite.config., webpack.config., etc.), package.json, source code containing datadogRum.init calls, and CI/CD workflows (.github/workflows/*.yml, vercel.json, etc.).
- Boundary markers: Uses a structured 7-step process with mandatory user confirmation checkpoints when values cannot be definitively verified from the source code.
- Capability inventory: Executes shell commands (find, grep) to inspect files, installs dependencies via package managers, and modifies build configuration files to register plugins.
- Sanitization: Instructs the agent to never invent values or use placeholders, requiring explicit user input if the environment context is ambiguous.
Audit Metadata