javascript-sdk
Pass
Audited by Gen Agent Trust Hub on Jul 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: Documentation examples in
references/agent-patterns.mdandreferences/tool-builder.mdillustrate tool handlers using theeval()function to process string inputs (e.g., for a calculator tool). While intended as simple demonstrations, this is an unsafe coding practice that could lead to arbitrary code execution if implemented as-is by a developer. - [EXTERNAL_DOWNLOADS]: The skill references the installation of the
@inferencesh/sdkpackage from npm and suggests adding thebelt-sh/cliskill usingnpx. These are standard procedures for utilizing the documented developer tools. - [SAFE]: No malicious patterns such as data exfiltration of sensitive files, credential harvesting, or hidden persistence mechanisms were found. The skill serves its stated purpose as a developer software development kit.
Audit Metadata