ai-sdk
Pass
Audited by Gen Agent Trust Hub on Sep 1, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions for installing official Vercel AI SDK packages (e.g.,
ai,@ai-sdk/openai,@ai-sdk/react) from the npm registry. These are well-known, trusted dependencies for TypeScript development. - [INDIRECT_PROMPT_INJECTION]: Documentation includes examples of processing untrusted external data (such as articles or user-provided files). The skill identifies the injection surface and mitigates it by explicitly warning against using
allowSystemInMessageswith untrusted history and documenting best practices fortoolApprovalto maintain human-in-the-loop control. - [DYNAMIC_EXECUTION]: The reference material describes the SDK's ability to execute model-generated code via sandboxed runtimes like QuickJS or Vercel Sandbox. These features are documented as standard SDK capabilities for build-time and runtime agent tasks.
- [COMMAND_EXECUTION]: Mentions of terminal UI and sandbox execution tools (e.g.,
@ai-sdk/tui,@ai-sdk/sandbox-just-bash) are provided in the context of developer tooling and sandboxed agent environments, following the SDK's intended usage patterns.
Audit Metadata