javascript-pro
Fail
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: CRITICALCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSMETADATA_POISONINGINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Automated security scanners (URLite) have flagged the documentation URL
https://jeffallan.github.io/claude-skills/skills/language/javascript-pro/as malicious.\n- [COMMAND_EXECUTION]: The skill requires the agent to execute shell commands includingeslint --fixandjestin the local environment as part of its core workflow (SKILL.md).\n- [METADATA_POISONING]: The main skill fileSKILL.mdwas flagged by file reputation scanners as malware. Additionally, the author listed in the YAML metadata (Jeffallan) differs from the platform-indicated author (emmraan), which may indicate impersonation.\n- [INDIRECT_PROMPT_INJECTION]:\n - Ingestion points: The skill reviews and refactors
.js,.mjs, and.cjscode files as well aspackage.jsonconfiguration.\n - Boundary markers: None. The skill does not instruct the agent to ignore or delimit potentially malicious instructions embedded in the JavaScript files it processes.\n
- Capability inventory: The skill uses
child_processfor command execution andfs/promisesfor extensive file system manipulation (references/node-essentials.md).\n - Sanitization: None. The skill does not validate or sanitize the content of the files before processing them or invoking external tools on their content.
Recommendations
- CRITICAL: 1 file(s) identified as malware by FileRep - DO NOT USE
- AI detected serious security threats
- Contains 2 malicious URL(s) - DO NOT USE
Audit Metadata