jquery-4
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONMETADATA_POISONING
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references the official jQuery CDN (code.jquery.com) and the npm registry for obtaining library files and the migration plugin. These are established, well-known, and trusted services for web development dependencies.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to analyze and refactor user-supplied source code. 1. Ingestion points: User-provided JavaScript and PHP code blocks provided for migration analysis. 2. Boundary markers: None identified in the instructions. 3. Capability inventory: The skill provides transformation rules for the agent to apply; it does not execute system commands or network requests itself. 4. Sanitization: None identified. The injection surface is inherent to the skill's primary purpose of code migration.
- [METADATA_POISONING]: The plugin.json metadata contains a truncated code snippet in the description field. While this appears to be a documentation bug rather than a malicious attempt to mislead, it represents poorly maintained metadata.
Audit Metadata