domo-js
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references downloading the
ryuu.jsSDK fromunpkg.com, which is a well-known CDN service for distributing NPM packages. - [INDIRECT_PROMPT_INJECTION]: The documentation defines several ingestion points for external data, such as datasets (
domo.getAll), page filters (onFiltersUpdated), and environment variables (onVariablesUpdated). These interfaces allow untrusted data from the Domo environment to enter the agent's context, which could potentially be used for indirect prompt injection if the data contains malicious instructions and is processed without proper sanitization.
Audit Metadata