jev-prose

Pass

Audited by Gen Agent Trust Hub on Oct 13, 2026

Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses the jev-prose CLI tool to analyze text files and process JSON feedback reports. Installation is performed locally via uv tool install from a package directory within the project.
  • [DATA_EXFILTRATION]: Text content is transmitted to a hosted backend for analysis. The skill documentation identifies the backend as being associated with Cloudflare services, which is a well-known technology provider.
  • [CREDENTIALS_UNSAFE]: The skill mentions the use of CLOUDFLARE_ACCOUNT_ID and CLOUDFLARE_API_TOKEN environment variables for authentication. It specifically instructs the agent not to print these secrets, following security best practices for credential handling.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze user-supplied prose, which represents a potential surface for indirect prompt injection. The instructions mitigate this by directing the agent to strictly preserve the user's intended facts and meaning while avoiding the addition of invented content.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 13, 2026, 03:53 PM