ai-native-development
Pass
Audited by Gen Agent Trust Hub on Apr 25, 2026
Risk Level: SAFE
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill's templates and reference code demonstrate the standard practice of using environment variables (e.g., OPENAI_API_KEY, PINECONE_API_KEY, ANTHROPIC_API_KEY) to manage API credentials securely via process.env.
- [EXTERNAL_DOWNLOADS]: The implementation examples facilitate interactions with well-known and trusted AI infrastructure providers, including OpenAI, Anthropic, Pinecone, and Weaviate.
- [COMMAND_EXECUTION]: An educational example of a calculator tool in references/agentic-workflows.md uses the JavaScript eval() function to process mathematical expressions. The skill includes documentation on the importance of input validation to mitigate risks associated with dynamic execution.
- [COMMAND_EXECUTION]: The SKILL.md documentation provides standard grep command examples to help developers search through the reference files.
- [PROMPT_INJECTION]: As the skill involves processing external data through RAG and agentic workflows, it acknowledges the surface for indirect prompt injection. It mitigates this by providing patterns for strict system prompts, boundary markers, and schema validation using libraries like Zod.
Audit Metadata