sasjs-lint
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references and utilizes the
@sasjs/lintNPM package and thesasjsCLI. These are official resources provided by the vendor 'sasjs' for the purpose of SAS code maintenance and are standard components of the tool's ecosystem. - [COMMAND_EXECUTION]: Instructions include the use of
sasjs lintandnpx sasjs lintto verify code quality. These commands are intended for local development environments and CI/CD pipelines to enforce linting rules. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external SAS code provided via files or text buffers. This represents an attack surface where maliciously crafted SAS code (e.g., in comments or headers) could attempt to influence the agent's behavior.
- Ingestion points: Untrusted code is ingested through
lintText,formatText, and thePOST /SASjsApi/code/lintAPI endpoint (SKILL.md). - Boundary markers: The documentation does not specify explicit boundary markers or instructions for the agent to ignore embedded commands within the processed SAS code.
- Capability inventory: The tool performs text analysis, formatting, and file modification (in 'fix' mode). The CLI outputs results to the terminal.
- Sanitization: The skill focuses on SAS syntax rules and does not explicitly describe sanitization against prompt injection patterns within the code being analyzed.
Audit Metadata