graph-engineering

Pass

Audited by Gen Agent Trust Hub on Aug 11, 2026

Risk Level: SAFE
Full Analysis
  • [PROMPT_INJECTION]: The skill proactively mitigates prompt injection by providing a mandatory node brief template that explicitly instructs sub-agents to treat all ingested material as data rather than instructions. This defense is reinforced by the orchestrator's synthesis rule that node outputs must be evaluated rather than blindly executed.
  • [DYNAMIC_EXECUTION]: The skill utilizes platform-native dynamic workflows to coordinate agents. This execution is performed in a controlled environment with schema validation and budget awareness, rather than arbitrary script execution. The JavaScript orchestration logic is locally generated by the agent based on user-approved design patterns.
  • [COMMAND_EXECUTION]: While the skill permits sub-agents to perform verification tasks using commands (e.g., testing code), it mandates the capture of execution receipts (exit codes and command outputs) and independent verification of these results to prevent fabricated outcomes.
  • [DATA_EXFILTRATION]: The skill facilitates the systematic review of project data but does not include any network exfiltration patterns, hardcoded credentials, or connections to unverified external services. All data flow is contained within the orchestrator-worker graph defined by the user.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 11, 2026, 10:47 PM
Security Audit — agent-trust-hub — graph-engineering