fingerprint-smart-signals
Pass
Audited by Gen Agent Trust Hub on Oct 4, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No security issues were detected. The skill serves as a developer guide and provides utility logic for interacting with the FingerprintJS Server API.
- [CREDENTIALS_UNSAFE]: The skill correctly identifies the need for secret management by utilizing environment variables (
FINGERPRINT_SECRET_API_KEY) for authentication rather than hardcoding sensitive tokens. - [EXTERNAL_DOWNLOADS]: All external resource links target official FingerprintJS documentation domains and their public GitHub repositories, which are trusted vendor-controlled sources.
- [INDIRECT_PROMPT_INJECTION]: The logic helper in
snippets/signals-policy.jsprocesses external event data using safe programming patterns (optional chaining) and returns decision strings without performing any high-risk operations like file system modifications or network exfiltration based on that data.
Audit Metadata