algolia-prod-checklist
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements strong security practices by explicitly instructing the agent never to include credential values in its output and limiting network access to official Algolia documentation via the WebFetch tool.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from local repositories to perform its production readiness review. While this presents a potential surface for indirect prompt injection if malicious instructions are present in the repository's configuration or code files, the skill's audit-focused nature and explicit instructions to avoid handling secrets mitigate the risk.
- Ingestion points: Reads local code, configuration names, and dependency versions from the provided repository path in SKILL.md.
- Boundary markers: None identified in instructions.
- Capability inventory: Utilizes Read, Glob, Grep, Write, and Edit tools across all review steps.
- Sanitization: Not explicitly implemented for external file content, but instructions emphasize verifying implementation authority via lockfiles.
Audit Metadata