code-review-nodejs
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to analyze untrusted third-party source code and pull requests. This represents a potential surface for indirect prompt injection where malicious code could contain instructions designed to deceive the AI agent.
- Ingestion points: Source code from Node.js applications, framework configurations, and package metadata in SKILL.md.
- Boundary markers: The instructions lack specific delimiters or warnings to separate the content being reviewed from the agent's internal logic.
- Capability inventory: The skill specifies the use of
semgrep,njsscan, andripgrepfor code analysis. - Sanitization: There is no mention of input sanitization or validation for the code being reviewed.
Audit Metadata