express
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill describes building web applications that ingest untrusted data through HTTP requests, which is an inherent property of web servers.
- Ingestion points: The skill documents methods for accessing untrusted data via
req.body,req.query,req.params,req.headers, andreq.ipinSKILL.md. - Boundary markers: While not applicable to the documentation itself, the skill instructs on setting up specific route handlers to isolate request processing.
- Capability inventory: The documented functionality includes network listening (
app.listen), static file serving (express.static), and general HTTP response capabilities. - Sanitization: The skill proactively recommends security-focused middleware including
helmetfor security headers,corsfor cross-origin resource sharing, andexpress-rate-limitfor DDoS protection in the 'Production hardening' section.
Audit Metadata