client-server-boundary
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill provides instructions for the agent to reason about and analyze code that processes untrusted external data such as client-supplied parameters and form data.
- Ingestion points: SKILL.md describes the processing of client input, route params, search params, and FormData within the codebase.
- Boundary markers: The instructions explicitly define trust boundaries using framework directives such as 'use client', 'use server', import 'server-only', and import 'client-only'.
- Capability inventory: The skill covers logic that involves sensitive operations including database access (db.user.update), file system reads (fs), and environment variable access.
- Sanitization: The skill mandates the use of runtime validation (e.g., Zod, valibot) and server-side authorization (requireSession) to secure data transitions.
Audit Metadata