sast-eslint-security
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill recommends installing the standard eslint and eslint-plugin-security packages via npm. These are widely recognized and trusted tools for security linting in the JavaScript ecosystem.
- [COMMAND_EXECUTION]: Uses npx to execute the ESLint scanner on a user-provided target path. This is the intended and legitimate function of the tool.
- [INDIRECT_PROMPT_INJECTION]: The skill processes scan results generated from analyzing external code which could contain malicious instructions. 1. Ingestion points: Analyzes target source files and reads the resulting eslint-security-results.json file. 2. Boundary markers: None explicitly defined to prevent the agent from following instructions embedded in findings. 3. Capability inventory: Performs local shell command execution via npx and reads local files. 4. Sanitization: Processes data using standard JSON formatting with no additional filtering for LLM instructions.
Audit Metadata