bullmq

Pass

Audited by Gen Agent Trust Hub on Sep 4, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The maintenance script scripts/check-updates.py performs a network request to the official NPM registry (registry.npmjs.org) to retrieve the latest version metadata for the BullMQ package. This is a well-known service, and the operation is restricted to checking version numbers for skill maintenance purposes.\n- [INDIRECT_PROMPT_INJECTION]: The skill provides patterns for processing job data within workers, identifying a surface where untrusted data could enter the agent's context (references/02-workers.md). The documentation follows best practices by recommending data encryption and referencing secrets externally rather than storing them in Redis payloads (references/12-production-nestjs.md).\n- [DYNAMIC_EXECUTION]: The documentation describes 'Sandboxed Processors' which load JavaScript files to handle CPU-intensive tasks (references/02-workers.md). The provided examples use static paths relative to the application directory, which is a standard and safe implementation for modular task isolation.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 4, 2026, 10:30 AM
Security Audit — agent-trust-hub — bullmq