csrf-protection
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is primarily instructional, providing code templates and documentation for implementing standard web security measures (CSRF tokens, SameSite cookies, and origin validation).
- [COMMAND_EXECUTION]: The script
scripts/security-checklist.shis a utility script used to generate a markdown checklist. It uses a shell heredoc to output static text to either/dev/stdoutor a user-specified file path. It does not execute external commands or interact with the network. - [CREDENTIALS_UNSAFE]: While the Python Flask implementation in
references/python-flask-csrf-protection.mdcontainsapp.config['SECRET_KEY'] = 'your-secret-key', this is identified as a standard placeholder for developer configuration and is not an actual hardcoded credential. - [DYNAMIC_EXECUTION]: The use of a shell script to generate a static file is categorized as low-risk template generation and does not involve the execution of untrusted or remote code.
Audit Metadata