javascript-sdk
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions for installing the @inferencesh/sdk NPM package and the belt-sh/cli tool. These are the primary libraries required for the SDK to function and are described neutrally within the setup documentation.
- [DYNAMIC_EXECUTION]: Documentation examples in the agent and tool builder sections demonstrate using eval() to process logic for a calculator tool. While standard in tutorial code, this serves as a reminder for developers to use safe alternatives when handling untrusted model outputs.
- [INDIRECT_PROMPT_INJECTION]: The library is designed to build agents that process external data, creating an inherent surface for indirect prompt injection. The documentation mitigates this by teaching human-in-the-loop patterns and the use of the requireApproval() method for sensitive tool executions.
Audit Metadata