markstream-install
Pass
Audited by Gen Agent Trust Hub on Aug 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the AI agent to execute shell commands for package management (e.g.,
npm install markstream-vue) and to run validation commands like build or type-check scripts. - [EXTERNAL_DOWNLOADS]: The skill facilitates downloading and installing external libraries from the NPM registry, including the core Markstream adapters and optional peer dependencies such as
mermaid,katex, and@terrastruct/d2. - [PROMPT_INJECTION]: Since the skill configures a Markdown rendering component that may ingest untrusted user data (a surface for Indirect Prompt Injection), it mandates the use of safe rendering defaults, specifically setting the HTML policy to 'safe' and Mermaid rendering to 'strict'.
Audit Metadata