skills/seed-hypermedia/seed/xstate/Gen Agent Trust Hub

xstate

Pass

Audited by Gen Agent Trust Hub on Oct 5, 2026

Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The utility script evals/extract_and_typecheck.py dynamically generates TypeScript source files and configuration (tsconfig.json) to perform automated type checking. It invokes npm install and tsc via subprocess.run to ensure code correctness. These operations are restricted to a designated workspace directory and represent standard developer tooling behavior.
  • [INDIRECT_PROMPT_INJECTION]: The skill facilitates the design and review of state machines based on user-provided requirements and legacy code. This creates a surface for indirect prompt injection, as malicious instructions could be hidden in the input data. However, the skill lacks high-privilege capabilities such as arbitrary network access or sensitive file system writes, reducing the risk to a minimal level consistent with a code generation assistant.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 5, 2026, 03:06 PM