ai-sdk-core
Pass
Audited by Gen Agent Trust Hub on Feb 17, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION] (LOW): The skill contains templates for Cloudflare Workers and Next.js Server Actions that interpolate user input into AI prompts, creating a surface for indirect prompt injection. Evidence Chain: 1. Ingestion points:
templates/cloudflare-worker-integration.ts(line 19) andtemplates/nextjs-server-action.ts(lines 14, 21, 39, 57). 2. Boundary markers: Absent. 3. Capability inventory:generateText,generateObject, and tool calling. 4. Sanitization: Absent. - [EXTERNAL_DOWNLOADS] (SAFE): Package dependencies are restricted to verified providers and established development tools.
- [COMMAND_EXECUTION] (SAFE): The
scripts/check-versions.shscript is a harmless utility for version management.
Audit Metadata