skills/statelyai/skills/xstate-v5/Gen Agent Trust Hub

xstate-v5

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The evaluation script evals/extract_and_typecheck.py performs package installation using npm install. This downloads well-known development dependencies, such as xstate and typescript, from the official npm registry.\n- [COMMAND_EXECUTION]: The evaluation script evals/extract_and_typecheck.py executes npm and tsc via subprocess.run to manage dependencies and verify the correctness of code snippets within a localized testing harness.\n- [DYNAMIC_EXECUTION]: The script evals/extract_and_typecheck.py performs runtime compilation by executing the TypeScript compiler (tsc) on code blocks extracted from markdown documentation.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided requirements and existing codebases, creating a potential surface for indirect prompt injection.\n
  • Ingestion points: The skill reads local package.json files, imports, and existing machine/actor code (SKILL.md).\n
  • Boundary markers: No explicit delimiters or instructions to ignore embedded commands are specified.\n
  • Capability inventory: The skill package includes scripts capable of file writing and tool execution in the evals/ directory.\n
  • Sanitization: No specific input sanitization or validation methods are described.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 05:00 AM