effect-best-practices
Pass
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The instructions recommend the use of
npx effect-language-service, which facilitates the download and execution of the diagnostic tool from the npm registry at runtime. - [COMMAND_EXECUTION]: The skill includes shell command templates for running project diagnostics using the
effect-language-serviceCLI and interacting with the TypeScript compiler configuration (tsconfig.json). - [INDIRECT_PROMPT_INJECTION]: As a code review and best-practice enforcement skill, it processes external source code which constitutes an indirect prompt injection surface.
- Ingestion points: TypeScript source code and project configuration files processed by the agent during code review or editing tasks.
- Boundary markers: None explicitly defined in the instructions for separating code content from the agent's internal reasoning.
- Capability inventory: Execution of CLI tools via shell commands and delegation of tasks to the
effect-advocatesubagent. - Sanitization: Relies on default agent behavior for handling source code content without explicit sanitization logic in the skill instructions.
- [SAFE]: The skill utilizes libraries and tools consistent with the Effect-TS ecosystem and the author's organizational scope, such as the
@salesforce/apex-lsp-parser-astpackage used for LSP logging integration.
Audit Metadata