apply-yliu-product-development-practices
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill functions as a documentation and workflow framework for software engineering. It provides structural guidance rather than executing opaque or dangerous operations.
- [CREDENTIALS_SAFE]: The documentation explicitly advises against hardcoding real credentials in configuration templates like
.env.exampleand promotes the use of environment variables for sensitive data, following security best practices. - [INDIRECT_PROMPT_INJECTION]: The skill recommends using Zod for runtime data validation and strict TypeScript types. This approach significantly reduces the attack surface for indirect injections by ensuring that external data conforms to expected schemas before processing.
- [EXTERNAL_DOWNLOADS]: References to external tools are limited to well-known, industry-standard ecosystems including NPM/Yarn/PNPM and reputable libraries such as Hono, Axios, Tailwind CSS, and Zod.
- [COMMAND_EXECUTION]: The skill describes standard developer workflows, including the use of testing frameworks (Vitest, Playwright) and Git pre-commit hooks for automated code formatting. These are transparent, standard practices in professional software development.
Audit Metadata