vanilla-lynx

Pass

Audited by Gen Agent Trust Hub on Jul 7, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill references the official @lynx-js/type-element-api package on the well-known NPM registry and provides links to official Lynx examples on GitHub for project scaffolding.
  • [COMMAND_EXECUTION]: Provides standard build and development commands (rspeedy build, rspeedy dev, pnpm dev) for a JavaScript development environment.
  • [DATA_EXFILTRATION]: The skill examples demonstrate reading application data from lynxCoreInject.tt._params (initialization and update data) and rendering it to the UI. This is standard functionality for the described framework.
  • [INDIRECT_PROMPT_INJECTION]:
  • Ingestion points: Untrusted data enters the agent context through lynxCoreInject.tt._params in references/double-thread-data-sync.md and examples/todo-list.md.
  • Boundary markers: Not explicitly defined in code templates.
  • Capability inventory: Uses __AddEvent for binding events and __SetAttribute/__AppendElement for UI updates across examples.
  • Sanitization: Examples include basic validation such as typeof and Array.isArray checks before processing data.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 7, 2026, 12:20 PM
Security Audit — agent-trust-hub — vanilla-lynx