rpgjs
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches documentation indices and guides from project-specific domains (v5.rpgjs.dev, canvasengine.net) and the official RPGJS GitHub repository.
- [COMMAND_EXECUTION]: Instructs the agent to use
curlfor downloading remote files andripgrep(rg) for text extraction. It also describes standard project setup procedures using package managers. - [INDIRECT_PROMPT_INJECTION]: The skill processes external text from documentation sources, which presents a surface for indirect prompt injection. This is mitigated by the use of official vendor documentation as the source.
- Ingestion points: Documentation files retrieved from
v5.rpgjs.devandcanvasengine.net(e.g.,llms.txt). - Boundary markers: No explicit delimiters are present in the instructions to separate documentation content from system prompts.
- Capability inventory: File system access, network access (curl), and shell command execution (ripgrep, npm/yarn).
- Sanitization: Content is ingested as raw text without validation or sanitization layers.
Audit Metadata