javascript-pro
Pass
Audited by Gen Agent Trust Hub on May 15, 2026
Risk Level: SAFECREDENTIALS_UNSAFEPROMPT_INJECTIONNO_CODE
Full Analysis
- [CREDENTIALS_UNSAFE]: Hardcoded credentials for a local test database are present in the reference materials as examples.
- File: references/javascript-testing-patterns.md
- Evidence: The PostgreSQL pool configuration uses hardcoded
user: "test_user"andpassword: "test_password"forlocalhost. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its role in analyzing untrusted user code.
- Ingestion points: User-provided JavaScript snippets analyzed via instructions in SKILL.md.
- Boundary markers: Absent; no delimiters or ignore-instructions are specified for the untrusted code snippets.
- Capability inventory: No executable scripts are included in the skill, but the agent's general capabilities may be exposed to the processed data.
- Sanitization: Absent; there are no defined methods for filtering or validating the code snippets before analysis.
- [NO_CODE]: The skill consists entirely of Markdown documentation and reference files, with no executable code or configuration manifests.
Audit Metadata