datocms-structured-text
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill's conversion workflow instructs the user to install necessary processing libraries from the official npm registry. The installation command explicitly uses
--ignore-scriptsto mitigate the risk of malicious code execution during the package installation phase.- [COMMAND_EXECUTION]: A local Node.js script (convert.mjs) is used to perform document conversion. This script uses standard Node.js APIs for file system access and includes logic to prevent accidental file overwriting through path canonicalization and inode checks.- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external content such as Markdown and HTML documents. - Ingestion points: Files are read via the
--inputflag inscripts/convert.mjs. - Boundary markers: The skill documentation emphasizes returning specific document objects and performing structural validation.
- Capability inventory: The skill performs local file read/write operations and structural tree transformations using specialized DAST libraries.
- Sanitization: The conversion script performs a detailed audit of input node types against a whitelist of supported semantic structures and utilizes a runtime validator (
datocms-structured-text-utils) to ensure output integrity.
Audit Metadata