secrets
Pass
Audited by Gen Agent Trust Hub on Jul 13, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill serves as infrastructure for secure secret management and does not contain any malicious instructions or scripts.
- [CREDENTIALS_UNSAFE]: The skill explicitly enforces a policy against hardcoding real credentials, requiring the use of environment-specific placeholders and encrypted storage. It provides standard masking (last 4 characters) for UI visibility.
- [EXTERNAL_DOWNLOADS]: The code examples reference internal vendor packages (
@agent-native/core) and standard libraries (zod), which are expected for the framework's operation. - [DATA_EXFILTRATION]: The skill incorporates security controls for its web-request tool, specifically a server-side substitution mechanism for
${keys.NAME}placeholders. This ensures raw secret values are never exposed to the AI model's context or training data. Additionally, ad-hoc secrets support URL allowlists to prevent credentials from being sent to unauthorized third-party origins. - [PROMPT_INJECTION]: No evidence of prompt injection, role-play instructions, or safety filter bypasses was found. The skill operates as technical documentation and configuration for developers.
Audit Metadata