jarvus-extjs

Pass

Audited by Gen Agent Trust Hub on Aug 25, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill references various vendor packages and utilities (e.g., jarvus-apikit, slate-core-data) hosted on the author's official repositories. These are standard dependencies for the application framework.
  • [REMOTE_CODE_EXECUTION]: Describes the use of dev-loader.js during development, which dynamically integrates remote application components ('chrome') into the local environment. This is documented as a core architectural requirement for local development against live backends.
  • [CREDENTIALS_UNSAFE]: Mentions the use of apiToken query parameters to authenticate local development builds against remote APIs. While query parameters can be captured in logs, this is identified as a specific development-time mechanism within the ecosystem.
  • [COMMAND_EXECUTION]: The testing documentation provides instructions for running Cypress tests, which includes executing commands within a Docker container (cy.resetDatabase) to manage testing fixtures. This is a standard practice for end-to-end testing environments.
  • [INDIRECT_PROMPT_INJECTION]: As the skill is designed to assist in code refactoring and maintenance, it inherently processes external codebase content.
  • Ingestion points: Reads existing application code (JS, SCSS, JSON) and user-provided task descriptions.
  • Boundary markers: None explicitly defined in the instructions.
  • Capability inventory: File writing and interaction with development tools (Sencha Cmd, Cypress).
  • Sanitization: No specific sanitization of ingested code is mentioned, relying on the agent's internal safety filters.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 25, 2026, 03:02 PM
Security Audit — agent-trust-hub — jarvus-extjs