code-review-nodejs
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to analyze external files such as
package.jsonand JavaScript source code (*.js,*.mjs), creating a potential attack surface where instructions embedded in the analyzed code could influence the agent's behavior. - Ingestion points: The skill targets project metadata (
package.json) and source code files (*.js,*.mjs) for analysis. - Boundary markers: The skill does not define specific delimiters or "ignore" instructions to prevent the agent from potentially obeying malicious prompts embedded in the reviewed code.
- Capability inventory: The skill provides reasoning logic for a code-reviewer agent that reads and interprets file contents to identify anti-patterns.
- Sanitization: There are no explicit instructions for sanitizing or filtering the content of the files before they are processed by the agent's logic.
Audit Metadata