fastify-v5

Pass

Audited by Gen Agent Trust Hub on Sep 1, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill provides standard development patterns for Fastify v5. No malicious code, obfuscation, or unauthorized data access patterns were detected.
  • [INDIRECT_PROMPT_INJECTION]: The skill facilitates the creation of APIs that ingest untrusted data from request parameters, queries, and bodies. However, it mandates the use of TypeBox schemas for validation and type-safety, which serves as a robust defense-in-depth measure against malformed input.
  • Ingestion points: API endpoints defined in templates/route-schema.ts ingest data through request.params, request.query, and request.body.
  • Boundary markers: The skill uses TypeBox Type.* constructors for schema definitions to strictly validate input.
  • Capability inventory: The skill itself does not perform dangerous operations like arbitrary shell command execution or direct file system manipulation.
  • Sanitization: Strict validation is enforced through fastify.withTypeProvider<TypeBoxTypeProvider>().
  • [DATA_EXPOSURE_&_EXFILTRATION]: The skill encourages the use of environment variables for configuration (e.g., process.env.PORT, process.env.BODY_LIMIT) in references/instance-config.md, which is a standard and safe practice for secret management.
  • [COMMAND_EXECUTION]: The skill includes code for graceful shutdown using process.on('SIGTERM', ...) and process.exit(0), which are standard Node.js lifecycle management patterns.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 1, 2026, 11:06 PM
Security Audit — agent-trust-hub — fastify-v5