rivetkit-client-javascript
Pass
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install the
rivetkitpackage from the official NPM registry and suggests adding therivet-dev/skillsrepository. These are legitimate resources associated with the Rivet development platform. - [INDIRECT_PROMPT_INJECTION]: Evaluated the ingestion points for actor keys and auth tokens. The skill documentation explicitly includes a security advisory against using string interpolation for keys, recommending array-based compound keys to prevent schema-based injection attacks.
- [COMMAND_EXECUTION]: Contains standard package installation and setup commands (
npm install,npx skills add) which are expected for the stated purpose of building a JavaScript client.
Audit Metadata