state-machines-pattern
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill documents patterns for ingesting external data into state machine context (e.g.,
FetchStateinreact-state-machines.mdandCheckoutContextinxstate-patterns.md). This represents a standard architectural surface area where external input enters the application state. - Ingestion points: Context objects defined in
SKILL.md,react-state-machines.md, andxstate-patterns.mddesigned to hold API responses and user input. - Boundary markers: Not explicitly defined in the provided code templates.
- Capability inventory: The skill is purely instructional and does not provide executable scripts or tools with network/filesystem capabilities.
- Sanitization: The examples focus on state transitions rather than data validation; sanitization of external data is left to the implementer.
- [EXTERNAL_DOWNLOADS]: The documentation provides standard installation instructions for well-known and trusted libraries.
- Evidence: References to
npm install xstate @xstate/reactand@xstate/testwhich are industry-standard tools for state management and testing. - [SAFE]: The skill uses deterministic transition tables and exhaustive union types to eliminate "impossible states," which is a defensive programming practice that enhances application security and reliability.
Audit Metadata