recon-js-analysis
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill describes a methodology for ingesting and analyzing external JavaScript files. This presents a theoretical surface where malicious instructions embedded in target code could influence agent behavior, though the skill itself is purely informational.
- Ingestion points: Target JavaScript files, lazy-loaded chunks, and source maps (SKILL.md).
- Boundary markers: None specified in the methodology.
- Capability inventory: The skill methodology mentions external tools (katana, linkfinder, jsluice) but does not provide scripts, subprocess calls, or file-write capabilities within the skill itself.
- Sanitization: Not addressed for the data being analyzed.
- [SAFE]: No malicious instructions, sensitive file access, or network exfiltration patterns were detected in the instructions or metadata.
Audit Metadata