bento
Pass
Audited by Gen Agent Trust Hub on Jul 14, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements strong security defaults for AI agent interactions with external services.
- [CREDENTIALS_UNSAFE]: The documentation explicitly instructs against hardcoding credentials, providing clear guidance on using environment variables, encrypted configuration, and secure profile stores across all supported frameworks.
- [EXTERNAL_DOWNLOADS]: All installation commands for SDKs and CLI tools target verified official registries (npm, Composer, PyPI, Hex) or the author's official GitHub repositories (github.com/bentonow). No untrusted third-party sources were detected.
- [COMMAND_EXECUTION]: The provided helper script (bento-sdk.mjs) is used for project analysis and printing guidance. It does not execute arbitrary shell commands or install software without user intervention, following the principle of user-initiated action.
- [DATA_EXFILTRATION]: There are no patterns suggesting unauthorized data access. The skill's primary function is data synchronization between the user's application and their own Bento account using authenticated official APIs.
- [PROMPT_INJECTION]: The instructions do not contain attempts to bypass agent safety filters or override system prompts. Instead, they include safety guardrails that prevent accidental high-volume email sends or data modifications without confirmation.
Audit Metadata