javascript-sdk
Pass
Audited by Gen Agent Trust Hub on Mar 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The documentation in
SKILL.mdandreferences/react-integration.mdinstructs users to download and install the@inferencesh/sdkpackage from the public NPM registry. - [COMMAND_EXECUTION]: Documentation in
references/agent-patterns.mdandreferences/tool-builder.mddescribes how to enable the SDK's built-in code execution capability for agents using theinternalTools().codeExecution(true)method. - [DYNAMIC_EXECUTION]: Educational code examples in
references/agent-patterns.mdandreferences/tool-builder.mddemonstrate the use ofeval()to process mathematical expressions provided by an agent through a tool call. - [PROMPT_INJECTION]: The skill architecture handles untrusted user input via the
agent.sendMessagefunction, as documented inSKILL.mdandreferences/react-integration.md. Ingestion points include direct user messages and file attachments. Capability inventory for agents includes tool execution (e.g., thedelete_fileexample inreferences/agent-patterns.md), server-side code execution, and network operations via webhook tools. The provided examples do not explicitly demonstrate boundary markers or sanitization for input data.
Audit Metadata