nestjs-expert

Fail

Audited by Gen Agent Trust Hub on Sep 5, 2026

Risk Level: CRITICALINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill architecture relies on ingesting user requirements to generate and execute code without explicit delimiters or instructions to ignore embedded commands. This creates a surface where malicious instructions hidden in application requirements could potentially influence the agent's logic.
  • Ingestion points: Requirement analysis phase described in the core workflow.
  • Boundary markers: Not present; the instructions do not specify how to isolate user requirements from the agent's system instructions.
  • Capability inventory: Shell execution capabilities including npm run test, npm run lint, and nest info.
  • Sanitization: Absent; there is no mention of filtering or validating the requirement text for instruction-like patterns.
  • [EXTERNAL_DOWNLOADS]: The skill metadata and documentation links point to jeffallan.github.io. Although this is a common hosting platform, the specific domain has been flagged by automated scanners. While no direct script downloads were observed, users should exercise caution with external links.
  • [COMMAND_EXECUTION]: The workflow incorporates the use of project-level CLI tools (npm, nest). These commands are standard for the described task but represent a capability that interacts with the local shell environment.
Recommendations
  • CRITICAL: 1 file(s) identified as malware by FileRep - DO NOT USE
  • Contains 2 malicious URL(s) - DO NOT USE
Audit Metadata
Risk Level
CRITICAL
Analyzed
Sep 5, 2026, 11:39 AM
Security Audit — agent-trust-hub — nestjs-expert