glean-prod-checklist
Pass
Audited by Gen Agent Trust Hub on Aug 21, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXPOSURE]: The skill uses the
GLEAN_API_KEYenvironment variable to authenticate requests tohttps://api.glean.com. The checklist explicitly recommends storing secrets in a dedicated secrets manager rather than configuration files, which aligns with security best practices. - [INDIRECT_PROMPT_INJECTION]: The validation script ingests data from external API responses (
api.glean.com) to verify connectivity. While this represents a data ingestion surface, the logic is limited to checking HTTP status codes and logging success or failure messages, posing minimal risk. - [EXTERNAL_DOWNLOADS]: The skill performs network operations to the official Glean API domain (
api.glean.com) for health checks. As Glean is a well-known enterprise service and the target of the skill's functionality, these operations are considered standard and safe.
Audit Metadata