evernote-security-basics
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill serves as a security-focused educational resource for developers. It provides clear guidance and implementation examples for protecting Evernote API integrations, emphasizing best practices like using environment variables and secret managers.
- [CREDENTIALS_UNSAFE]: The skill appropriately addresses the risks of hardcoded credentials. It uses generic placeholders in code examples and provides instructions for integrating with secure storage solutions such as AWS Secrets Manager and GCP Secret Manager.
- [INDIRECT_PROMPT_INJECTION]: The skill identifies user-supplied content (ENML) as a potential injection vector and provides sanitization logic to mitigate risks like cross-site scripting (XSS). This proactive approach helps developers build more secure applications.
- [EXTERNAL_DOWNLOADS]: The implementation guide references standard, widely-used Node.js packages for cloud services and authentication (e.g., @aws-sdk/client-secrets-manager, evernote, express). These are recognized as legitimate dependencies for the stated purpose of the skill.
Audit Metadata