fastify-v5
Pass
Audited by Gen Agent Trust Hub on Sep 1, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides standard development patterns for Fastify v5. No malicious code, obfuscation, or unauthorized data access patterns were detected.
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the creation of APIs that ingest untrusted data from request parameters, queries, and bodies. However, it mandates the use of TypeBox schemas for validation and type-safety, which serves as a robust defense-in-depth measure against malformed input.
- Ingestion points: API endpoints defined in
templates/route-schema.tsingest data throughrequest.params,request.query, andrequest.body. - Boundary markers: The skill uses TypeBox
Type.*constructors for schema definitions to strictly validate input. - Capability inventory: The skill itself does not perform dangerous operations like arbitrary shell command execution or direct file system manipulation.
- Sanitization: Strict validation is enforced through
fastify.withTypeProvider<TypeBoxTypeProvider>(). - [DATA_EXPOSURE_&_EXFILTRATION]: The skill encourages the use of environment variables for configuration (e.g.,
process.env.PORT,process.env.BODY_LIMIT) inreferences/instance-config.md, which is a standard and safe practice for secret management. - [COMMAND_EXECUTION]: The skill includes code for graceful shutdown using
process.on('SIGTERM', ...)andprocess.exit(0), which are standard Node.js lifecycle management patterns.
Audit Metadata