eslint
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to analyze user-provided source code, which serves as a vector for indirect prompt injection through malicious comments or code patterns.\n
- Ingestion points: Source code files (JavaScript, TypeScript, React, Vue) analyzed by the agent (referenced in SKILL.md, references/migration_guide.md, and assets/eslint.config.examples.js).\n
- Boundary markers: The skill instructions do not specify any delimiters or safety markers to isolate user code from the agent's reasoning process, relying on default platform handling.\n
- Capability inventory: The skill utilizes file read access for analysis and supports commands that write to the filesystem, such as 'npx eslint --fix'.\n
- Sanitization: No specific filtering or sanitization measures are mentioned to handle potentially deceptive instructions embedded within code comments or string literals.
Audit Metadata