tampermonkey
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions for installing the @types/tampermonkey package from the official NPM registry and references well-known script CDNs like code.jquery.com and jsdelivr.net for loading external libraries. These are standard industry resources for web development.
- [DYNAMIC_EXECUTION]: The skill documents the use of Tampermonkey APIs, such as GM_addElement and unsafeWindow, that facilitate the dynamic injection and execution of JavaScript within browser tabs. This behavior is the defining functionality of the platform the skill supports.
- [INDIRECT_PROMPT_INJECTION]: The skill assists in generating code based on user-provided descriptions and provides a safety framework to prevent vulnerabilities: (1) Ingestion points: User-provided script requirements. (2) Boundary markers: The skill includes a mandatory Pre-Delivery Checklist and a dedicated security-checklist.md to guide the agent in producing safe code. (3) Capability inventory: The skill uses tools for reading and writing files (Read, Write, Edit) to manage script development. (4) Sanitization: Documentation explicitly instructs on the use of textContent and HTML escaping to prevent cross-site scripting (XSS) in generated scripts.
Audit Metadata