feature-module
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill templates and instructions were analyzed and found to be standard for software development. The provided boilerplate includes security best practices, such as ownership checks in the service layer and validation schemas using Zod. No malicious patterns, such as credential theft or unauthorized network access, were found.
- [EXTERNAL_DOWNLOADS]: The checklist at the end of the skill suggests using
drizzle-kitvianpxfor database migrations. This is a standard developer tool associated with the Drizzle ORM ecosystem. - [INDIRECT_PROMPT_INJECTION]: The skill defines a process where user-provided names are interpolated into file structures and source code. While this constitutes a data ingestion surface, the risk is managed by the templated nature of the output.
- Ingestion points: User-supplied name for the new feature or module in SKILL.md.
- Boundary markers: Not specified in the instructions.
- Capability inventory: Writing multiple TypeScript files to the filesystem (
modules/[name]/...). - Sanitization: Not explicitly provided in the skill instructions; it relies on the agent's default handling of string interpolation.
Audit Metadata