sequential-thinking
Pass
Audited by Gen Agent Trust Hub on Apr 11, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill manages state by writing to a local JSON file (
.thought-history.json) within its own script directory. This is used exclusively for tracking the sequence of thoughts and does not access any sensitive user data or system configurations. - [COMMAND_EXECUTION]: The provided Node.js scripts (
process-thought.jsandformat-thought.js) are utility tools for validating and displaying data. They do not execute arbitrary shell commands or spawn untrusted subprocesses. - [EXTERNAL_DOWNLOADS]: The
package.jsonfile includesjestfor testing purposes, which is a standard development dependency. The skill does not perform any runtime downloads or remote script executions. - [INDIRECT_PROMPT_INJECTION]: The skill processes arbitrary text input as 'thoughts'. While there is no sanitization of this content, the processing logic is restricted to local state management and terminal formatting, presenting a minimal attack surface with no identified escalation path.
- [PROMPT_INJECTION]: The instructions in
SKILL.mdare focused on problem-solving methodology and contain no patterns intended to bypass safety filters or override the agent's core instructions.
Audit Metadata