flexport-sdk-patterns
Pass
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: SAFE
Full Analysis
- [CREDENTIALS_UNSAFE]: The code snippets demonstrate best practices for secret management by retrieving API keys from environment variables (such as
process.env.FLEXPORT_API_KEYandos.environ['FLEXPORT_API_KEY']) instead of using hardcoded credentials. - [INDIRECT_PROMPT_INJECTION]: The skill implements patterns for processing external API data and specifically includes response validation using the Zod library. This acts as a security control to ensure that data fetched from external endpoints matches expected schemas before it is processed by the application logic.
- [DATA_EXFILTRATION]: Network communication is directed to
api.flexport.com, which is the official endpoint for the service described in the skill. There are no signs of data being sent to unauthorized or suspicious external domains. - [COMMAND_EXECUTION]: The skill does not contain any shell commands, subprocess invocations, or operations that could lead to unauthorized command execution.
Audit Metadata