p-eng-trigger-dev
Pass
Audited by Gen Agent Trust Hub on Apr 16, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill uses the official Trigger.dev SDK (@trigger.dev/sdk/v3) to facilitate long-running workflow orchestration, which is a legitimate and well-known service.
- [SAFE]: Implements an
InternalApiGuardfor NestJS controllers to secure callback endpoints. This guard validates a shared secret (BACKEND_INTERNAL_API_KEY) passed in thex-internal-api-keyheader, which is a standard pattern for securing internal service-to-service communication. - [SAFE]: Adheres to secure credential management by instructing users to store sensitive keys (like
TRIGGER_SECRET_KEY) in environment variables and access them via the NestJSConfigServicerather than hardcoding them. - [COMMAND_EXECUTION]: The pattern uses the NestJS CQRS
CommandBusto handle domain logic triggered by external tasks. This is a controlled execution of predefined commands within the application's domain layer. - [EXTERNAL_DOWNLOADS]: The documentation mentions using
pnpm dlx trigger.dev@latestto run the development worker. This is a standard utility provided by Trigger.dev for local development.
Audit Metadata