server-actions-design
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is purely instructional and follows security best practices for web development. It provides comprehensive guidance on treating server functions as untrusted public endpoints.
- [INDIRECT_PROMPT_INJECTION]: The skill acknowledges the risk of untrusted data ingestion via
FormDataand hidden inputs. It mitigates this by instructing the agent to always use server-side validation (e.g., via Zod) and session-based authorization rather than trusting client-provided identifiers. - [EXTERNAL_DOWNLOADS]: The skill references official documentation from React (react.dev) and Next.js (nextjs.org), which are recognized as well-known and trusted services. It also links to the author's GitHub repository for project context, which is consistent with the vendor identity.
- [DATA_EXFILTRATION]: No patterns for exfiltrating sensitive data were found. The skill emphasizes returning only client-safe data from mutations.
- [OBFUSCATION]: No obfuscated URLs, Base64-encoded commands, or hidden characters were detected in the instructions or code examples.
Audit Metadata