sota-javascript-typescript
Pass
Audited by Gen Agent Trust Hub on Aug 5, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: The skill contains no instructions designed to bypass agent safety filters or override system behaviors. Instead, it defines strict operational modes (BUILD and AUDIT) focused on engineering excellence and security auditing.\n- [DATA_EXFILTRATION]: No hardcoded credentials or malicious data exfiltration patterns were found. The skill actively promotes secure credential management, recommending HttpOnly cookies and warning against storing secrets in localStorage.\n- [REMOTE_CODE_EXECUTION]: The skill explicitly forbids dangerous patterns like eval() and new Function() with dynamic input. It provides guidance on preventing command injection by using execFile with array-based arguments rather than shell-interpolated strings.\n- [COMMAND_EXECUTION]: The skill provides numerous grep command templates intended for use by the agent to audit codebases. While these are search-oriented, the skill correctly identifies the risks of shell interpolation and teaches defensive command execution practices.\n- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted code. It mitigates this by instructing the agent to look for specific vulnerability patterns and confirming attacker control before reporting issues, effectively serving as a security tool.
Audit Metadata