rollup-bundler
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to read and process local project files to generate build configurations.
- Ingestion points: Importing
package.jsonto extract metadata and dependency information. - Boundary markers: The instructions do not define specific delimiters or warnings to ignore potentially malicious instructions embedded in project metadata.
- Capability inventory: The skill facilitates the creation and modification of configuration files like
rollup.config.mjs. - Sanitization: No explicit sanitization or validation of the content within
package.jsonis described before it is used to influence configuration logic. - [EXTERNAL_DOWNLOADS]: The configuration examples reference several well-known Rollup plugins.
- Details: The skill suggests using established plugins such as
@rollup/plugin-node-resolve,@rollup/plugin-commonjs, and@rollup/plugin-typescriptto extend bundler functionality.
Audit Metadata