reverse-eng-js
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill instructs the agent to extract JavaScript code from external web applications and execute it within a local Node.js environment to reproduce cryptographic or signing algorithms. This process involves the execution of potentially untrusted third-party code.
- [INDIRECT_PROMPT_INJECTION]: The skill establishes a workflow for ingesting and processing external JavaScript source code, which serves as a surface for embedded instructions to influence the agent. 1. Ingestion points: JavaScript source code captured from the target application's front-end. 2. Boundary markers: The instructions do not specify the use of delimiters or warnings to ignore instructions within the captured data. 3. Capability inventory: The skill makes use of
nodejsandchrome-devtoolsto execute and inspect the code. 4. Sanitization: There is no requirement or guidance for sanitizing the extracted code before it is analyzed or executed.
Audit Metadata