deobfuscate-javascript
Warn
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: MEDIUMDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The script 'scripts/unpack.ts' uses 'new Function()' to parse and execute code for Packer and AAEncode deobfuscation. While required for its primary purpose and accompanied by a '--no-eval' safety flag, evaluating untrusted code strings is an inherent risk.
- [DYNAMIC_EXECUTION]: In 'scripts/vendor-npm-preflight.ts', the skill uses dynamic 'import()' to load and inspect modules from the local workspace for validation. This could be exploited if an attacker can control the files being analyzed.
- [EXTERNAL_DOWNLOADS]: The skill utilizes 'npx' and 'bunx' in 'scripts/wakaru-normalize.ts' and 'scripts/format.ts' to execute external tools like '@wakaru/cli' and 'prettier'. This involves running code from the npm registry at runtime without fixed checksums.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted JavaScript data as context for the agent. Malicious files could contain instructions designed to influence the agent's behavior during naming or review phases. The skill lacks explicit boundary markers or sanitization logic to isolate untrusted data.
Audit Metadata