nodejs-expert

Pass

Audited by Gen Agent Trust Hub on Sep 28, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill employs standard shell commands to verify the environment, such as checking Node.js and npm versions and identifying which package manager lock file is present in the directory.
  • [DYNAMIC_EXECUTION]: The skill uses the node -e flag to execute short, inline JavaScript snippets that extract configuration details from the project's metadata files.
  • [INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection as it reads and parses the content of the local package.json file to identify project frameworks and module configurations.
  • Ingestion points: package.json (retrieved via require calls within node -e commands).
  • Boundary markers: None present.
  • Capability inventory: Local file system read access and environment detection capabilities.
  • Sanitization: None performed on the file content before processing.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 28, 2026, 02:36 PM