ai-code-mode
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [DYNAMIC_EXECUTION]: The skill's primary function is the runtime execution of TypeScript code generated by an LLM. It supports multiple isolation drivers to mitigate risk, but the execution of non-static code generated from untrusted inputs is a high-capability feature that requires strict isolation.
- [INDIRECT_PROMPT_INJECTION]: The skill implements a workflow where user-provided messages are processed by an LLM to generate executable code, establishing a surface for indirect prompt injection.
- Ingestion points: User-provided messages in the
POSTrequest handler (SKILL.md). - Boundary markers: Not explicitly defined in the provided snippets beyond standard system prompts.
- Capability inventory: Subprocess execution via isolate drivers, network requests via tool definitions, and file system persistence via snippet storage.
- Sanitization: Relies on sandbox isolation drivers (e.g.,
isolated-vm, QuickJS) and developer-defined tool schemas. - [EXTERNAL_DOWNLOADS]: The Cloudflare isolate driver involves sending execution tasks to a developer-managed worker URL. This establishes a dependency on external infrastructure for code execution.
Audit Metadata