refactor-auth-hardening
Pass
Audited by Gen Agent Trust Hub on Jul 6, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes a local utility script (
scripts/checklist.mjs) to analyze the environment. This script is zero-dependency, performs only read operations for configuration checking, and does not perform any network activity or shell injection. - [REMOTE_CODE_EXECUTION]: No remote code execution or untrusted package installation patterns were found. The skill references well-known authentication libraries (e.g., Auth0, Passport, Next-Auth) as signals for activation but does not execute external scripts from those sources.
- [DATA_EXFILTRATION]: No unauthorized network requests or patterns for exfiltrating sensitive data like tokens or environment variables were detected. The skill specifically instructs the agent to move secrets to environment variables and redact them from reports.
- [PROMPT_INJECTION]: The skill instructions do not contain attempts to bypass safety filters or override agent constraints. It maintains a strict scope of 'refactoring' and explicitly forbids adding new authentication systems where none exist.
- [SAFE]: The skill implements best-practice guardrails, including 'behavior preservation' invariants, human-in-the-loop confirmation for user-visible changes (like cookie domain shifts), and strict 'secure-swap' sequences to prevent accidental breakage during the hardening process.
Audit Metadata