fcode-core-concepts
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No security risks were identified. The content is instructional and follows established security best practices for secret management and input handling.
- [INDIRECT_PROMPT_INJECTION]: The documentation identifies attack surfaces where the platform ingests untrusted data and details its capabilities, though it mitigates these risks by mandating validation and schema enforcement.
- Ingestion points: The skill describes processing untrusted data from webhook request bodies, request headers, and process parameters (
fcode.context.parameters). - Boundary markers: The platform utilizes
parametersSchema.jsonto define and enforce input structures. - Capability inventory: The platform supports sending emails (
fcode.sendMail), managing execution schedules (fcode.schedule), and programmatically updating workspace variables (fcode.variables.set). - Sanitization: The instructions explicitly direct developers to "Validate inputs early" and check required parameters and types at the start of every process.
Audit Metadata