security-review
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill serves as a security-focused instructional guide for AI agents to follow when assisting with development tasks. It provides clear 'Dos' and 'Don'ts' for common security scenarios.
- [EXTERNAL_DOWNLOADS]: The skill references and recommends industry-standard security libraries and tools, including Zod for validation, DOMPurify for sanitization, and TruffleHog for secret scanning. These are well-known services and do not pose a security risk in this context.
- [CREDENTIALS_UNSAFE]: The skill contains examples of hardcoded credentials (e.g.,
sk-proj-xxxxx) but strictly for the purpose of identifying them as insecure practices to be avoided. It correctly instructs the use of environment variables and secrets managers. - [INDIRECT_PROMPT_INJECTION]: The skill defines clear boundaries and verification steps for the agent to use when reviewing external data or user-provided code, which helps mitigate risks associated with untrusted input processing.
Audit Metadata