sb-audit-nodejs
Pass
Audited by Gen Agent Trust Hub on May 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: Executes several standard Node.js development and auditing tools via the command line, including
npm audit,npx depcheck,npx madge,npx tsc,npx eslint,npm outdated, andgit log.\n- [EXTERNAL_DOWNLOADS]: Utilizesnpx -y, which may automatically download and execute the latest versions of auditing tools (depcheck,madge,ts-prune) from the official npm registry if they are not already installed locally.\n- [PROMPT_INJECTION]: The skill processes untrusted project source code and configuration files, creating an indirect prompt injection surface.\n - Ingestion points:
package.json,tsconfig.json, lockfiles, and the entire source code directory via theExploresubagent.\n - Boundary markers: No explicit delimiters are used to separate untrusted file content from instructions.\n
- Capability inventory: File writing (
docs/tech-status-*.md) and command execution (npx,npm).\n - Sanitization: No explicit sanitization or filtering of ingested code or tool outputs is performed before synthesizing the report.
Audit Metadata