xstate-v5
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The evaluation script
evals/extract_and_typecheck.pyperforms package installation usingnpm install. This downloads well-known development dependencies, such asxstateandtypescript, from the official npm registry.\n- [COMMAND_EXECUTION]: The evaluation scriptevals/extract_and_typecheck.pyexecutesnpmandtscviasubprocess.runto manage dependencies and verify the correctness of code snippets within a localized testing harness.\n- [DYNAMIC_EXECUTION]: The scriptevals/extract_and_typecheck.pyperforms runtime compilation by executing the TypeScript compiler (tsc) on code blocks extracted from markdown documentation.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided requirements and existing codebases, creating a potential surface for indirect prompt injection.\n - Ingestion points: The skill reads local
package.jsonfiles, imports, and existing machine/actor code (SKILL.md).\n - Boundary markers: No explicit delimiters or instructions to ignore embedded commands are specified.\n
- Capability inventory: The skill package includes scripts capable of file writing and tool execution in the
evals/directory.\n - Sanitization: No specific input sanitization or validation methods are described.
Audit Metadata