recommend
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using
nodeand potentiallyyarn nodeto resolve package paths and query installed metadata. - [DYNAMIC_EXECUTION]: The skill utilizes
node -e(evaluate) to run complex JavaScript logic embedded within the instructions. This logic dynamically imports and iterates through the exports of the locally installedes-toolkitlibrary at runtime. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided requirements (
$ARGUMENTS) to influence the search pattern used in its inspection script. Malicious input could theoretically be crafted to manipulate the generated JavaScript execution string, posing a low-severity injection risk.
Audit Metadata