insforge
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides integration guidelines for
@insforge/sdkandinsforge-cli. All referenced domains (insforge.app,insforge.dev), NPM packages (@insforge/sdk,@insforge/cli), and code patterns relate strictly to legitimate vendor functionalities for the author 'insforge'. - [EXTERNAL_DOWNLOADS]: Contains standard instructions to install package dependencies via npm (
@insforge/sdk,openai) and external links to official OpenRouter documentation, which are handled neutrally as expected configuration settings. - [CREDENTIALS_UNSAFE]: Environment variable instructions correctly advise keeping secrets like
INSFORGE_API_KEYandOPENROUTER_API_KEYstrictly server-side, using standard.envconfiguration practices with proper.gitignorerecommendations. Placeholder keys used in documentation examples do not pose a risk. - [INDIRECT_PROMPT_INJECTION]: The AI module integration documentation outlines how to handle user data dynamically when building RAG or chat pipelines with pgvector. The documentation explicitly prescribes security best practices, including enforcing Row Level Security (RLS) and re-filtering data by authenticated user context (
auth.uid()) to mitigate injection risks.
Audit Metadata