web-state-zustand
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill was evaluated against all threat categories. No malicious patterns, such as prompt injection, data exfiltration, or unauthorized command execution, were found. The provided TypeScript examples utilize standard browser APIs and the well-known Zustand library for UI state management.
- [INDIRECT_PROMPT_INJECTION]: The skill includes an example in
examples/core.mdthat reads data fromwindow.location.search. Analysis of the evidence chain: 1. Ingestion point:window.location.searchinexamples/core.md. 2. Boundary markers: Absent. 3. Capability inventory: No high-risk capabilities (file writing, network operations, or shell execution) are present in the skill's code examples. 4. Sanitization: The skill correctly notes that parameters arrive as strings and require parsing. Given the lack of dangerous capabilities, this surface is considered safe.
Audit Metadata