fondo-security-basics
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFE
Full Analysis
- [DATA_PROTECTION]: The skill includes logic to prevent sensitive financial and personal data exposure, such as the
redactFondoLogfunction which identifies and replaces PII fields like SSNs and bank account numbers with redaction markers. - [INPUT_VALIDATION]: The implementation uses the
zodlibrary to enforce strict schema validation for tax filing data, including UUID format checks, specific date ranges, and regex enforcement for EINs, which helps prevent malformed or malicious data injection. - [CREDENTIALS_SAFE]: The code snippets and instructions correctly advocate for using environment variables and secret managers for API keys and webhook secrets, explicitly warning against hardcoding credentials in source code.
- [COMMAND_EXECUTION]: The skill uses a limited set of allowed tools (Read, Write, Grep) and does not contain any evidence of dangerous shell command execution or unauthorized system access.
- [REMOTE_CODE_EXECUTION]: All imports (
crypto,express,zod) refer to standard, well-known libraries, and there are no instances of dynamic execution or remote script fetching.
Audit Metadata