javascript-sdk

Pass

Audited by Gen Agent Trust Hub on Jul 23, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: Documentation examples in references/agent-patterns.md and references/tool-builder.md illustrate tool handlers using the eval() function to process string inputs (e.g., for a calculator tool). While intended as simple demonstrations, this is an unsafe coding practice that could lead to arbitrary code execution if implemented as-is by a developer.
  • [EXTERNAL_DOWNLOADS]: The skill references the installation of the @inferencesh/sdk package from npm and suggests adding the belt-sh/cli skill using npx. These are standard procedures for utilizing the documented developer tools.
  • [SAFE]: No malicious patterns such as data exfiltration of sensitive files, credential harvesting, or hidden persistence mechanisms were found. The skill serves its stated purpose as a developer software development kit.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 23, 2026, 06:03 PM
Security Audit — agent-trust-hub — javascript-sdk