skills/jasim/sapporta-skills/sapporta/Gen Agent Trust Hub

sapporta

Pass

Audited by Gen Agent Trust Hub on Oct 13, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill fetches documentation, API references, and code recipes from the official vendor domain (sapporta.com) and established technology sites like tanstack.com. This ensures the agent has access to the most recent framework specifications.
  • [COMMAND_EXECUTION]: Employs standard development utilities including pnpm, git, and rg, along with the framework's CLI tool (sapporta), to perform tasks such as project initialization, database migrations, and code inspection.
  • [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to retrieve instructions and code snippets from remote markdown files on the vendor's site. While this constitutes a remote instruction source, it is limited to official product documentation.
  • Ingestion points: Multiple reference files (e.g., SKILL.md, references/app-building/tables/create.md) specify curl operations to sapporta.com subpaths.
  • Boundary markers: The skill notes that code recipes should be obtained verbatim but does not define explicit delimiters for the remote content.
  • Capability inventory: The agent possesses capabilities for file system access, shell command execution via pnpm, and database operations.
  • Sanitization: No sanitization of the fetched remote content is described before it influences agent behavior.
  • [SAFE]: Implements secure handling for authentication tokens by directing users to provide them through a setup prompt, which avoids exposing sensitive credentials in source code or shell history.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 13, 2026, 09:40 AM