composition-root
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructions define an architecture for processing untrusted data from external entrypoints such as HTTP requests, queues, and scheduled events.
- Ingestion points: Data enters through Cloudflare Worker fetch, queue, and scheduled handlers (SKILL.md, Section 1), as well as TanStack Start middleware and server functions (EXAMPLES.md).
- Boundary markers: The skill explicitly instructs to parse external input in entrypoint adapters and provides examples using .validator() for input schema enforcement in server functions.
- Capability inventory: The skill manages access to Cloudflare platform services, including KV, D1, R2, and Durable Objects, through binding adapters (SKILL.md, Section 2).
- Sanitization: The instructions emphasize using domain inputs and parsed outputs rather than raw strings or request objects, effectively advocating for input sanitization and validation at the system boundary.
- [COMMAND_EXECUTION]: The skill provides rg (ripgrep) command patterns in the "Verify the seam" section (SKILL.md, Section 5). These commands are designed to help developers identify leaks of raw platform types by searching the local source directory for types such as KVNamespace, R2Bucket, and ExecutionContext.
Audit Metadata