sillytavern-component-update
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes local Node.js scripts for file generation and validation. These scripts, specifically
scripts/build-importable-component.mjs, include explicit checks to prevent path traversal by ensuring all file operations remain within the intended staging directory. - [INDIRECT_PROMPT_INJECTION]: The skill processes JSON specifications provided by the user to generate artifacts. It mitigates potential injection risks through comprehensive schema validation, regex syntax checks, and SHA-256 hashing to ensure data integrity during the build process in
scripts/plan-component-update.mjs. - [SAFE]: No evidence of data exfiltration, hardcoded credentials, or obfuscated code was found. The skill operates exclusively on local files within a defined staging environment and uses standard built-in Node.js modules.
Audit Metadata