@ruvector/graph-data-generator

Pass

Audited by Gen Agent Trust Hub on Mar 5, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPROMPT_INJECTIONNO_CODE
Full Analysis
  • [COMMAND_EXECUTION]: The documentation provides instructions to use npx to install and run the @ruvector/graph-data-generator and ruvector packages from the npm registry.
  • [EXTERNAL_DOWNLOADS]: The skill requires downloading external packages from npmjs.com and communicates with OpenRouter for its AI-powered generation features.
  • [DATA_EXFILTRATION]: The property generation feature (propertyGenerator: 'ai') sends metadata and schema definitions to OpenRouter's API (specifically the moonshotai/kimi-k2 model) to facilitate realistic data synthesis.
  • [PROMPT_INJECTION]: The skill presents an indirect prompt injection surface. * Ingestion points: The propertySchema object in SKILL.md allows users to define property types and descriptions. * Boundary markers: There are no documented delimiters or instructions to ignore embedded commands in the schema. * Capability inventory: The tool possesses file-writing capabilities through the gen.export() method across various formats (CSV, JSON, Cypher) as documented in SKILL.md and commands.md. * Sanitization: The documentation does not specify any sanitization or validation of the schema content before it is interpolated into AI prompts.
  • [NO_CODE]: This skill consists entirely of documentation and instructions in Markdown format and does not include any standalone executable scripts or binaries within the provided file list.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 5, 2026, 05:23 PM
Security Audit — agent-trust-hub — @ruvector/graph-data-generator