javascript-pro

Pass

Audited by Gen Agent Trust Hub on Sep 28, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The reference materials provide standard implementation patterns for Node.js child_process modules, such as exec and spawn, intended for legitimate backend task execution as documented in references/node-essentials.md.
  • [DYNAMIC_EXECUTION]: The skill documents the use of dynamic import() calls and multi-threading via Web Workers and Worker Threads, which are standard features for optimizing and modularizing modern applications as seen in references/modules.md and references/node-essentials.md.
  • [EXTERNAL_DOWNLOADS]: The defined workflow includes the use of industry-standard tools for code quality and verification, specifically eslint and jest.
  • [INDIRECT_PROMPT_INJECTION]: The skill's primary function involves analyzing external project files and requirements while maintaining powerful capabilities like file system and network access, presenting a standard surface for indirect prompt injection.
  • Ingestion points: Analyzes user-provided source code, package.json, and architectural requirements as specified in the SKILL.md workflow.
  • Boundary markers: The skill relies on natural language instructions rather than explicit structural boundaries to separate instructions from data.
  • Capability inventory: Comprehensive file system access (fs/promises), shell command execution (child_process), and network connectivity (fetch, http) are all included in the developer reference guides.
  • Sanitization: Implementation examples demonstrate defensive programming, such as basic character escaping and robust error handling in references/modern-syntax.md.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 28, 2026, 09:45 AM