d6e-auth-integration
Pass
Audited by Gen Agent Trust Hub on Aug 10, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill documents standard OAuth2 flows and provides clear security guidance, such as using HTTP-only cookies, SameSite=Lax attributes, and CSRF protection via state cookies.
- [SAFE]: All external resources, including URLs and GitHub repositories, belong to the vendor
d6e-aior its trusted infrastructure, representing normal vendor functionality. - [SAFE]: The skill includes explicit warnings against insecure practices, such as logging access tokens, exposing API keys in client-side code, or using insecure redirect URIs.
- [SAFE]: The documentation uses illustrative placeholders for environment variables (e.g.,
D6E_INIT_REFRESH_TOKEN=<paste refresh token JWT>) to guide developers without including actual hardcoded secrets. - [SAFE]: The skill promotes secure redirect handling by recommending sanitization and restricted same-origin path checks to prevent open redirect vulnerabilities.
Audit Metadata