extension-core-infrastructure
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied SSO domains to facilitate authentication discovery. While this processes external input, it follows standard OpenID Connect discovery patterns, and the documentation provides explicit instructions for domain validation and restricted input handling.
- [DYNAMIC_EXECUTION]: The skill uses a development-time feature to dynamically load local mock backend modules from the application's source directory using Vite's glob import functionality. This is restricted to specific local file paths and is intended for visual QA and testing purposes when enabled via environment variables.
- [EXTERNAL_DOWNLOADS]: The skill identifies several Node.js dependencies including standard industry SDKs for authentication and core protocol interactions, as well as vendor-specific packages under the @caffeineai scope. These dependencies are appropriate for the skill's stated purpose as a core infrastructure provider.
Audit Metadata