jotai-nextjs
Pass
Audited by Gen Agent Trust Hub on Feb 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION] (LOW): The skill suggests using
npm viewto fetch package metadata, which is a read-only shell operation. - [EXTERNAL_DOWNLOADS] (LOW): It employs
npx -y mcporterfor querying library documentation, involving the download of an external package. - [REMOTE_CODE_EXECUTION] (LOW): The use of
npxeffectively executes remote package code; however, this is used for documentation retrieval and is downgraded due to its alignment with the skill's primary purpose. - [INDIRECT_PROMPT_INJECTION] (LOW): The skill processes data from external command outputs and documentation, creating a surface for indirect prompt injection.
- Ingestion points: Outputs from
npmandmcporter. - Boundary markers: Absent.
- Capability inventory: Shell command execution (
npm,npx). - Sanitization: Absent.
Audit Metadata