fcode-examples

Pass

Audited by Gen Agent Trust Hub on Sep 8, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The reference implementations describe processes that ingest untrusted data from multiple external sources. * Ingestion points: Input parameters are processed in webhook-triggered components (references/custom-app-linear.md) and file content is retrieved from storage in utility automations (references/utility-processes.md). * Boundary markers: The skill relies on platform-enforced authentication modes (authMode: TEAM) and specific header validation (x-factorial-wh-challenge) to delimit external requests. * Capability inventory: The demonstrated processes have the capacity to make outbound network requests via fetch and vendor SDKs, perform local file system operations (fs.writeFileSync), and distribute information via email (fcode.sendMail). * Sanitization: The examples provide specific logic for escaping CSV cell content and utilizing structured XML parsers to handle external inputs safely.
  • [EXTERNAL_DOWNLOADS]: The skill references the installation of external Node.js packages for extended functionality. * References the use of @linear/sdk for interacting with the Linear API, which is a well-known service. * References the fast-xml-parser library for processing uploaded XML documents.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 8, 2026, 06:57 AM
Security Audit — agent-trust-hub — fcode-examples