backend-security-coder
Pass
Audited by Gen Agent Trust Hub on Nov 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill's instructions and reference material are entirely focused on promoting secure coding standards and defensive programming techniques. No malicious patterns, obfuscation, or unauthorized data access attempts were found.
- [INDIRECT_PROMPT_INJECTION]: The skill exhibits an inherent attack surface due to its primary function of analyzing user-provided backend code and schemas.
- Ingestion points: Processes untrusted content such as 'Endpoint code', 'request schema', and 'identity/tenant model' as defined in resources/implementation-playbook.md.
- Boundary markers: Lacks explicit instruction to the agent to treat user-provided code as inert data or to use specific delimiters when processing examples.
- Capability inventory: The skill defines capabilities for generating code, configuring authentication (JWT, OAuth), and setting up logging/monitoring, which could be misused if the agent is influenced by malicious payloads within the analyzed code.
- Sanitization: There are no explicit sanitization steps for the data the agent processes, although the skill's purpose is to implement sanitization for the target application.
Audit Metadata