flow-ptr-app
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions for cloning application templates from the official ShotGrid Software GitHub organization (
github.com/shotgunsoftware) and searching for existing functionality via the GitHub API. These references target trusted vendor repositories. - [COMMAND_EXECUTION]: The skill utilizes standard development tools, including
gitfor version control and thetankCLI tool, which is the native management utility for the ShotGrid Toolkit environment. These commands are used for configuration, installation, and deployment within the developer's controlled environment. - [CREDENTIALS_UNSAFE]: The skill includes a specific guide on Python API best practices that emphasizes security hygiene. It explicitly advises developers to use separate API keys per script, monitor key usage, and utilize read-only permission groups to minimize the risk of accidental data exposure or credential misuse.
- [INDIRECT_PROMPT_INJECTION]: The skill involves processing project configuration data retrieved via the Flow Production Tracking API. To mitigate potential risks from untrusted data, the guide instructs developers to perform a security and data-privacy review during the specification phase (Phase 2.2) and strongly recommends developing within isolated sandbox configurations (Phase 3.2).
Audit Metadata