brandapp-sdk-review
Pass
Audited by Gen Agent Trust Hub on May 14, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses shell commands like
grep,npm install, andnpxto check dependency versions, update vendor packages, and validate code changes using the TypeScript compiler. These are standard operations for a local development tool. - [EXTERNAL_DOWNLOADS]: The skill facilitates downloading the official
@reopt-ai/brandapp-sdkfrom a package registry when an upgrade is recommended. This is a legitimate vendor resource. - [PROMPT_INJECTION]: The skill analyzes local project files (
package.jsonand TypeScript source files) to identify specific code patterns. While this represents a surface for indirect prompt injection (where malicious code comments could attempt to influence the audit report), the skill's logic is constrained to structural pattern matching. - Ingestion points:
package.json,**/*.tsfiles. - Capability inventory: Shell execution (
npm,npx,grep), file modification via editing tools. - Boundary markers: None specified in the instructions.
- Sanitization: None specified.
Audit Metadata