dx-delivery-sdk
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill recommends using the official
@contentstack/delivery-sdkand an external utility package@timbenniks/contentstack-endpointsfor handling region-specific API hosts. These are standard libraries within the Contentstack developer ecosystem. - [CREDENTIALS_UNSAFE]: The skill explicitly instructs the agent to never hardcode credentials and provides code examples using environment variable placeholders (e.g.,
process.env.CONTENTSTACK_API_KEY), which is a recommended security practice. - [COMMAND_EXECUTION]: The skill is restricted to file-reading tools (
Read,Grep,Glob) and does not request or use tools capable of arbitrary shell command execution. - [DATA_EXFILTRATION]: No network-capable tools are requested. The skill performs localized analysis of provided reference documentation to ensure code correctness.
- [INDIRECT_PROMPT_INJECTION]: While the skill processes external documentation (
references/delivery-sdk-spec.md), this data is stored locally within the skill package. The skill lacks the capabilities (network or write access) to be exploited via standard indirect injection vectors.
Audit Metadata