typescript-lsp
Pass
Audited by Gen Agent Trust Hub on Nov 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to analyze project source code, which introduces a surface for indirect prompt injection. Maliciously crafted code files could contain instructions hidden in comments or strings intended to manipulate the agent's reasoning.
- Ingestion points: Processes local files with extensions including .ts, .tsx, .js, .jsx, .mts, .cts, .mjs, and .cjs.
- Boundary markers: No specific delimiting or instruction-ignoring markers are specified for the processed content.
- Capability inventory: The skill leverages the
run_commandcapability to execute the language server CLI. - Sanitization: The instructions do not define any sanitization, validation, or filtering of the file contents before they are processed by the agent.
Audit Metadata