nodejs
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill contains technical documentation and architectural guidance for building Node.js services. It explicitly instructs the agent to avoid committing secrets and to follow security best practices such as validating environment variables and using secure webhook signature verification.
- [SAFE]: All external links point to official documentation for well-known and trusted services, including Node.js and Stripe.
- [INDIRECT_PROMPT_INJECTION]: The skill describes handling external data from webhooks (e.g., Stripe). While this presents a theoretical attack surface for indirect prompt injection, the instructions focus on maintaining data integrity for cryptographic signature verification, which is a defensive security measure. Severity is assessed as safe/low.
- Ingestion points: HTTP request bodies on
/webhooks/*routes. - Boundary markers: None specified in the provided code snippets beyond standard HTTP headers.
- Capability inventory: Native HTTP server creation and Express middleware configuration.
- Sanitization: Instructs the agent to preserve raw body bytes for verification, ensuring the authenticity of external data before processing.
Audit Metadata