skills/sasjs/skills/sasjs-lint/Gen Agent Trust Hub

sasjs-lint

Pass

Audited by Gen Agent Trust Hub on Oct 1, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill references and utilizes the @sasjs/lint NPM package and the sasjs CLI. These are official resources provided by the vendor 'sasjs' for the purpose of SAS code maintenance and are standard components of the tool's ecosystem.
  • [COMMAND_EXECUTION]: Instructions include the use of sasjs lint and npx sasjs lint to verify code quality. These commands are intended for local development environments and CI/CD pipelines to enforce linting rules.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external SAS code provided via files or text buffers. This represents an attack surface where maliciously crafted SAS code (e.g., in comments or headers) could attempt to influence the agent's behavior.
  • Ingestion points: Untrusted code is ingested through lintText, formatText, and the POST /SASjsApi/code/lint API endpoint (SKILL.md).
  • Boundary markers: The documentation does not specify explicit boundary markers or instructions for the agent to ignore embedded commands within the processed SAS code.
  • Capability inventory: The tool performs text analysis, formatting, and file modification (in 'fix' mode). The CLI outputs results to the terminal.
  • Sanitization: The skill focuses on SAS syntax rules and does not explicitly describe sanitization against prompt injection patterns within the code being analyzed.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 1, 2026, 11:31 PM