build-agent-python
Pass
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill enforces high-standard security practices, including the use of bcrypt or argon2 for password hashing and the mandatory use of parameterized queries via SQLAlchemy or raw SQL to prevent SQL injection.
- [SAFE]: It implements proactive security checks through halt conditions that trigger if the agent detects hardcoded secrets, SQL injection vulnerabilities, or missing database migrations.
- [SAFE]: The skill utilizes well-established, reputable Python libraries for all tasks, including FastAPI for APIs, pytest for testing, and ruff for linting, minimizing supply chain risk.
- [INDIRECT_PROMPT_INJECTION]: The agent is designed to ingest requirement documents (REQ-XXXX) as seen in SKILL.md. While this creates an ingestion surface for untrusted data, the skill includes boundary markers such as structured traceability headers, human review gates, and manifest requirements to mitigate the risk of instructions being confused with data. The agent's capabilities (file writing, test execution) are gated by mandatory security checklists and validation protocols.
Audit Metadata