javascript-pro
Fail
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: CRITICALEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONMETADATA_POISONING
Full Analysis
- [EXTERNAL_DOWNLOADS]: The documentation link "https://jeffallan.github.io/claude-skills/skills/language/javascript-pro/" is flagged as malicious by automated scanners.
- [COMMAND_EXECUTION]: The skill workflow requires the agent to run shell commands like "eslint --fix" on local project files.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted code and configuration files.
- Ingestion points: The agent reads "package.json" and source code files during the initial analysis phase.
- Boundary markers: No delimiters or instructions are provided to separate user-provided content from instructions.
- Capability inventory: The skill utilizes shell execution for linting, and reference guides include capabilities for file system access ("fs/promises") and network requests ("fetch").
- Sanitization: No sanitization of project content is mentioned or implemented.
- [METADATA_POISONING]: The author stated in the frontmatter ("Jeffallan") is inconsistent with the expected developer context ("harshsinghmp").
Recommendations
- CRITICAL: 1 file(s) identified as malware by FileRep - DO NOT USE
- AI detected serious security threats
- Contains 2 malicious URL(s) - DO NOT USE
Audit Metadata