built-in-ai
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides technical documentation and instructions for using Chrome Built-in AI APIs. It includes official Web IDLs and links to authoritative documentation.
- [REMOTE_CODE_EXECUTION]: The
fetch-idls.jsscript fetches technical specifications from the W3C Web Machine Learning community group repositories on GitHub to keep the skill's documentation updated. These are well-known and trusted official sources for web standards. - [INDIRECT_PROMPT_INJECTION]: While the skill informs the agent on how to process various data types (text, audio, visual), it specifically includes instructions in
AGENTS.mdto treat LLM outputs as untrusted content and requires the use ofDOMPurifyfor sanitization to prevent injection attacks. - [COMMAND_EXECUTION]: The package uses standard
postinstallscripts to synchronize markdown templates (SKILL.md,AGENTS.md) to the project root, which is the intended and documented behavior of this utility.
Audit Metadata