payload
Pass
Audited by Gen Agent Trust Hub on Aug 11, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references standard initialization commands such as
npx create-payload-app@latestand various official Payload CMS packages (e.g.,@payloadcms/db-mongodb,@payloadcms/plugin-seo). These are from well-known and trusted sources. - [COMMAND_EXECUTION]: The skill provides standard development commands (
npx,pnpm dev) and explains how to use the Payload Local API. It explicitly warns about the security implications ofoverrideAccess: truein the Local API, which is a significant security best practice. - [DATA_EXFILTRATION]: No unauthorized network activity or credential harvesting was found. The skill correctly instructs developers to use environment variables (
process.env.PAYLOAD_SECRET,process.env.DATABASE_URL) for sensitive configuration, following industry standards. - [PROMPT_INJECTION]: The instructions focus purely on software development patterns and do not contain any language attempting to override agent safety protocols or bypass constraints.
- [REMOTE_CODE_EXECUTION]: The skill does not contain any patterns for downloading and executing untrusted scripts. All code examples are standard TypeScript/JavaScript for use within a Next.js/Payload environment.
Audit Metadata