fw-app-dev
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill retrieves official SDK binaries and UI components from vendor-controlled domains (cdn.freshdev.io, static.freshdev.io) and established CDNs (jsdelivr.net, unpkg.com). These resources are essential for building compliant platform applications.
- [COMMAND_EXECUTION]: The skill invokes the Freshworks CLI (fdk) and internal orchestration scripts within a dedicated local vendor directory (~/.fw-dev-tools/) to automate app validation and migration tasks. This behavior is consistent with the primary purpose of a developer tool.
- [INDIRECT_PROMPT_INJECTION]: The skill processes and modifies user-provided code and configuration files in the workspace. While this creates a potential ingestion surface for indirect prompt injection if the source files are malicious, the skill provides specific security enforcement rules and checklists to mitigate risks during code generation.
Audit Metadata