javascript-pro
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The reference materials provide standard implementation patterns for Node.js
child_processmodules, such asexecandspawn, intended for legitimate backend task execution as documented inreferences/node-essentials.md. - [DYNAMIC_EXECUTION]: The skill documents the use of dynamic
import()calls and multi-threading via Web Workers and Worker Threads, which are standard features for optimizing and modularizing modern applications as seen inreferences/modules.mdandreferences/node-essentials.md. - [EXTERNAL_DOWNLOADS]: The defined workflow includes the use of industry-standard tools for code quality and verification, specifically
eslintandjest. - [INDIRECT_PROMPT_INJECTION]: The skill's primary function involves analyzing external project files and requirements while maintaining powerful capabilities like file system and network access, presenting a standard surface for indirect prompt injection.
- Ingestion points: Analyzes user-provided source code,
package.json, and architectural requirements as specified in theSKILL.mdworkflow. - Boundary markers: The skill relies on natural language instructions rather than explicit structural boundaries to separate instructions from data.
- Capability inventory: Comprehensive file system access (
fs/promises), shell command execution (child_process), and network connectivity (fetch,http) are all included in the developer reference guides. - Sanitization: Implementation examples demonstrate defensive programming, such as basic character escaping and robust error handling in
references/modern-syntax.md.
Audit Metadata