appfolio-security-basics
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides secure boilerplate code for AppFolio integrations, utilizing environment variables for secret management rather than hardcoding credentials.
- [SAFE]: Implements industry-standard cryptographic practices for webhook verification, including constant-time comparison to mitigate timing side-channel attacks via
crypto.timingSafeEqual. - [INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted tenant data from external API responses and webhooks, creating a surface for indirect injection.
- Ingestion points: AppFolio API responses and inbound webhook payloads as demonstrated in
SKILL.md. - Boundary markers: Recommends raw-body route configuration and signature verification prior to data mutation to ensure data integrity.
- Capability inventory: The skill allows access to
Bash(curl:*),Read,Write, andEdittools as defined in the frontmatter configuration. - Sanitization: Employs
zodfor strict schema enforcement and a manual redaction utility for PII fields to prevent sensitive data exposure in logs.
Audit Metadata