security-best-practices
Pass
Audited by Gen Agent Trust Hub on Nov 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill provides templates for building API endpoints that process untrusted data from
req.bodyanduserInput. - Ingestion points: The skill demonstrates handling external input via Express.js request objects (
req.body) inSKILL.md. - Boundary markers: No explicit boundary markers or instructions to ignore embedded prompts are provided in the code templates.
- Capability inventory: The demonstrated code interacts with databases (
db.query) and renders data back to the user. - Sanitization: The skill proactively includes security mitigations such as
Joivalidation,DOMPurifyfor XSS prevention, and parameterized queries to mitigate SQL injection.
Audit Metadata