sanity-check
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill installs the 'rivetkit' and '@rivetkit/react' packages from the public npm registry or the 'pkg.pr.new' preview service. These are vendor-owned resources associated with the skill author 'rivet-dev'.
- [DYNAMIC_EXECUTION]: The skill generates a 'package.json' and a 'test.mjs' file at runtime within a temporary directory. It subsequently executes this code using 'node' and 'npx tsx' to perform the sanity check.
- [COMMAND_EXECUTION]: The skill uses shell commands to create temporary directories, copy example source files, install dependencies via 'npm', and optionally execute tests inside a Docker container ('node:22').
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user input in the form of version strings and 'additional test behavior' instructions. These inputs are interpolated into shell commands and generated scripts. While this creates an injection surface, it is consistent with the skill's primary purpose as a flexible test runner.
Audit Metadata