settings-system
Pass
Audited by Gen Agent Trust Hub on Jul 13, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill documentation outlines a standard approach to handling multi-tenant application settings. It correctly advises using Laravel's built-in encryption for sensitive data such as API keys and tokens. The use of unique constraints and explicit agency scoping are standard architectural patterns. The skill does not contain any executable scripts, network requests, or obfuscated code.
- [PROMPT_INJECTION]: The skill describes a system that retrieves settings data, which could potentially contain instructions from external third-party services like Xero or Stripe if the agent processes the retrieved JSON without validation.
- Ingestion points: Data is retrieved using the Setting model methods like
forAgencyas described in SKILL.md. - Boundary markers: The instructions do not define specific delimiters to separate ingested data from agent instructions.
- Capability inventory: The agent is instructed on how to perform read and write operations on the settings database using the Setting Eloquent model.
- Sanitization: Encryption is used for secrets, but no explicit schema validation or input sanitization is mentioned for the general JSON data payload.
Audit Metadata