sanity-best-practices
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The documentation references standard, well-known npm packages and CLI tools from Sanity.io (e.g., @sanity/client, next-sanity) and established frontend frameworks. These are trusted sources according to the vendor scope.
- [COMMAND_EXECUTION]: The guides provide standard command-line instructions for project initialization, schema deployment, and infrastructure management using the Sanity CLI. These are intended for developer use and do not involve silent or malicious execution.
- [CREDENTIALS_SAFE]: The skill provides explicit warnings and best practices for secret management. It correctly distinguishes between client-safe public environment variables and server-only secrets, advising against the exposure of API tokens in browser bundles.
- [OBFUSCATION]: The documentation discusses 'Stega' (invisible characters embedded in strings used for visual editing). While this involves hidden characters, the skill provides a clear 'Golden Rule' and the
stegaCleanutility to sanitize these values before they are used in application logic, mitigating potential side effects. - [SAFE]: Overall, the skill is purely instructional and follows security best practices for content modeling and web development.
Audit Metadata