diffs
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill comprises documentation, API references, and usage examples for the @pierre/diffs library. All external references are to vendor-owned packages or established web frameworks. The provided recipes follow standard development practices for React and vanilla JavaScript. No malicious patterns, such as obfuscation, credential theft, or unauthorized persistence, were found across the 18 analyzed files.
- [INDIRECT_PROMPT_INJECTION]: The library is designed to ingest and display untrusted content like code and patches, representing a potential data ingestion surface.
- Ingestion points: Data is accepted through components and functions described in api-core.md, api-react.md, and api-ssr.md (e.g., FileContents, patch strings).
- Boundary markers: None explicitly documented for LLM instruction isolation, as the library's scope is UI rendering.
- Capability inventory: Capabilities include DOM rendering, syntax highlighting via Shiki, and a text editor interface.
- Sanitization: Content is tokenized and transformed into HAST (Hypertext Abstract Syntax Tree) structures before being rendered as HTML, which provides inherent protection against common text-based injection attacks in a browser context.
Audit Metadata