ai-sdk-core
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONMETADATA_POISONING
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill documentation and templates recommend using
npx ai migrate. This command downloads and executes the official migration tool from theaipackage, which is managed by a trusted organization (Vercel). - [EXTERNAL_DOWNLOADS]: The skill requires the installation of several Node.js packages (
ai,@ai-sdk/openai,@ai-sdk/anthropic,@ai-sdk/google,zod,workers-ai-provider) from the npm registry. All these packages originate from well-known technology companies and trusted open-source organizations. - [COMMAND_EXECUTION]: A diagnostic shell script (
scripts/check-versions.sh) is provided to check the versions of installed AI SDK packages usingnpm listandnpm view. This is a standard utility for development environments. - [INDIRECT_PROMPT_INJECTION]: The skill provides templates that process user-supplied text through large language models. The provided documentation in
references/production-patterns.mdspecifically addresses this risk, recommending prompt sanitization and input length limits as best practices. - [METADATA_POISONING]: The skill contains references to future-dated technologies and dates (e.g., GPT-5, Claude 4.5, and 2025 timelines). While factually incorrect relative to current real-world availability, these references appear to be hypothetical examples for documentation purposes rather than malicious deceptive content.
Audit Metadata