vanilla-lynx
Pass
Audited by Gen Agent Trust Hub on Jul 7, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references the official
@lynx-js/type-element-apipackage on the well-known NPM registry and provides links to official Lynx examples on GitHub for project scaffolding. - [COMMAND_EXECUTION]: Provides standard build and development commands (
rspeedy build,rspeedy dev,pnpm dev) for a JavaScript development environment. - [DATA_EXFILTRATION]: The skill examples demonstrate reading application data from
lynxCoreInject.tt._params(initialization and update data) and rendering it to the UI. This is standard functionality for the described framework. - [INDIRECT_PROMPT_INJECTION]:
- Ingestion points: Untrusted data enters the agent context through
lynxCoreInject.tt._paramsinreferences/double-thread-data-sync.mdandexamples/todo-list.md. - Boundary markers: Not explicitly defined in code templates.
- Capability inventory: Uses
__AddEventfor binding events and__SetAttribute/__AppendElementfor UI updates across examples. - Sanitization: Examples include basic validation such as
typeofandArray.isArraychecks before processing data.
Audit Metadata