security-best-practices
Pass
Audited by Gen Agent Trust Hub on Aug 30, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill acts as a repository of security best practices, providing extensive reference files that map out known vulnerabilities and secure-by-default coding standards for popular frameworks like Django, FastAPI, Express, React, and Vue. It explicitly instructs the agent to avoid sensitive data exposure and prohibits the creation of insecure code patterns.
- [INDIRECT_PROMPT_INJECTION]: The skill's primary function involves analyzing untrusted source code from a user's repository, which constitutes an attack surface for indirect prompt injection. However, the instructions are fundamentally defensive.
- Ingestion points: The agent is instructed in
SKILL.mdto identify the project's language and frameworks by inspecting the repository and reading files in the project scope. - Boundary markers: The instructions do not define specific delimiters for separating project code from agent instructions in the output reports.
- Capability inventory: The skill is capable of generating markdown report files (
security_best_practices_report.md) and can be configured to perform git commits of security fixes. - Sanitization: No specific input sanitization instructions are provided, although the agent is strictly prohibited from outputting or logging secrets.
Audit Metadata