sanity-check
Pass
Audited by Gen Agent Trust Hub on Jul 3, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Downloads 'rivetkit' and '@rivetkit/react' packages from the public npm registry or from 'pkg.pr.new' (a service used for PR previews). These resources are consistent with the identified author 'rivet-dev'.
- [COMMAND_EXECUTION]: Executes system commands including 'npm install', 'node', and 'npx' to set up the environment and run tests. The skill mitigates risk by performing these operations in a temporary directory or an isolated Docker container.
- [REMOTE_CODE_EXECUTION]: Executes code from the downloaded npm packages. This is a core requirement of the skill's purpose to verify that a specific build or version of the library is functional.
- [PROMPT_INJECTION]: The skill interpolates a user-provided version string directly into a generated 'package.json' file. While necessary for the testing process, it relies on the agent to ensure the version string is a valid npm package specifier.
Audit Metadata