eslint
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill analyzes repository configuration files, which presents a potential surface for indirect prompt injection. This is a common characteristic of tools that analyze external codebase content to determine project state.
- Ingestion points: The skill reads package.json, eslint.config., .eslintrc, and tsconfig.json from the user's repository as specified in the Workflow and Bootstrap sections.
- Boundary markers: No specific delimiters or instructions to ignore embedded prompts are defined for the content of the files being read.
- Capability inventory: The skill can execute shell commands (npm install, npx eslint) and modify files in the repository.
- Sanitization: The skill does not perform specific sanitization of the content found within the configuration files before it is processed.
- [SAFE]: The skill uses industry-standard tools and follows best practices.
- The installation of eslint via npm targets a standard package from a well-known registry.
- The use of npx eslint for linting and autofixing is a standard development practice.
- The skill correctly prioritizes repository-local dependencies over global ones to ensure consistency.
Audit Metadata