nodejs-expert
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill employs standard shell commands to verify the environment, such as checking Node.js and npm versions and identifying which package manager lock file is present in the directory.
- [DYNAMIC_EXECUTION]: The skill uses the
node -eflag to execute short, inline JavaScript snippets that extract configuration details from the project's metadata files. - [INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection as it reads and parses the content of the local
package.jsonfile to identify project frameworks and module configurations. - Ingestion points:
package.json(retrieved viarequirecalls withinnode -ecommands). - Boundary markers: None present.
- Capability inventory: Local file system read access and environment detection capabilities.
- Sanitization: None performed on the file content before processing.
Audit Metadata