assemblyai-prod-checklist
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill includes a code template for a webhook handler which acts as a potential ingestion surface for untrusted external data.
- Ingestion points: The webhook handler snippet in SKILL.md reads from the request body (req.body) to process transcription results and errors.
- Boundary markers: The example code does not implement boundary markers or instructions to delimit untrusted content.
- Capability inventory: The skill environment provides access to kubectl and curl tools.
- Sanitization: No explicit data sanitization is shown in the illustrative code snippets.
- [SAFE]: The skill explicitly instructs users to store sensitive API keys in dedicated secrets managers rather than configuration files, adhering to security best practices.
- [SAFE]: Deployment rollout instructions include health checks targeting the official AssemblyAI status API, which is a well-known and trusted service endpoint.
Audit Metadata