moai-lang-javascript
Pass
Audited by Gen Agent Trust Hub on Feb 17, 2026
Risk Level: SAFE
Full Analysis
- COMMAND_EXECUTION (SAFE): The skill utilizes several Bash-based tools, but specifically restricts them to a set of predefined binaries (node, npm, npx, yarn, pnpm, bun, deno, jest, vitest, eslint, prettier, biome). This restricted scope follows the principle of least privilege, preventing arbitrary command execution while enabling necessary development workflows.\n- EXTERNAL_DOWNLOADS (SAFE): While the skill mentions using package managers like
npmandbunto install dependencies (e.g.,vitest,eslint), these are standard operations for the intended use case of a JavaScript development specialist. No suspicious or unknown remote scripts are downloaded or executed.\n- INDIRECT_PROMPT_INJECTION (LOW): The skill is designed to process external project files likepackage.jsonand.jsfiles. While this creates a surface for indirect prompt injection, there are no specific patterns suggesting the skill is vulnerable to or encouraging the execution of instructions embedded in those files beyond standard code analysis.
Audit Metadata