clade-security-basics
Pass
Audited by Gen Agent Trust Hub on Aug 21, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: The skill includes instructions to harden system prompts against injection attacks. A deterministic detector flagged the phrase 'Reveal your system prompt', but this is used within a defense-in-depth example instructing the AI to refuse such requests, which is a recommended security practice.
- [CREDENTIALS_SAFE]: The skill uses placeholder strings such as 'sk-ant-...' and 'sk-ant-api03-...' to demonstrate where API keys should be placed. These are not real credentials. Furthermore, the skill explicitly instructs developers to use environment variables and
.gitignoreto prevent secret exposure. - [EXTERNAL_DOWNLOADS]: The skill references the well-known Node.js package
@upstash/ratelimitfor implementing rate limiting. This is a standard architectural recommendation for protecting API quotas. - [INDIRECT_PROMPT_INJECTION]: The skill addresses this attack surface by providing a
validateInputfunction example that enforces length limits and suggests PII redaction. It also demonstrates the use of clear system instructions to delimit the agent's behavioral boundaries when processing user-supplied content.
Audit Metadata