arkui-api-design
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill is primarily instructional, providing best practices for API design within the OpenHarmony ecosystem. It does not contain any malicious code or hidden payloads.
- [COMMAND_EXECUTION]: The skill instructs the user or agent to use local tools such as
./build.shandgrepfor SDK compilation and verification. These are standard development tasks within the intended environment. - [DYNAMIC_EXECUTION]: The skill includes a formal coding guide that explicitly prohibits the use of
eval(),with(), and theFunctionconstructor, which reduces the risk of dynamic code execution vulnerabilities. - [EXTERNAL_DOWNLOADS]: The
tests/package.jsonfile lists standard development dependencies (typescript,ts-node,nodemon) from the public NPM registry, which is typical for a test suite. - [INDIRECT_PROMPT_INJECTION]: The skill involves processing user-provided API requirements, representing a surface for indirect injection.
- Ingestion points: User chat input and code snippets for API review.
- Boundary markers: None implemented in the skill instructions.
- Capability inventory: Shell execution (
./build.sh,grep) and file system access across scripts. - Sanitization: None implemented in the instruction logic. This category is assessed as safe as the skill acts on direct user input within a defined development context.
Audit Metadata