frappe-core-permissions
Pass
Audited by Gen Agent Trust Hub on Jun 19, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill consists of instructional Markdown files providing best practices for Frappe/ERPNext permission systems. It does not contain any executable code, scripts, or external dependencies.
- [SAFE]: No prompt injection or behavior override patterns were detected. The instructions focus on guiding the developer to use built-in security APIs correctly.
- [SAFE]: No data exposure or exfiltration risks were identified. The skill does not access sensitive local files or perform unauthorized network operations. It provides advice on avoiding sensitive data leaks in error messages.
- [SAFE]: No obfuscation techniques, hidden characters, or encoded payloads were found in any of the analyzed files.
- [SAFE]: The skill provides explicit warnings and remediation guidance for security risks such as SQL injection in permission hooks, recommending the use of
frappe.db.escape(). - [SAFE]: No privilege escalation or persistence mechanisms are suggested. Usage of administrative overrides (
ignore_permissions) is correctly framed as a last resort that must be documented.
Audit Metadata