hootsuite-local-dev-loop
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill demonstrates secure secret management practices by instructing the user to store sensitive credentials such as access tokens and client secrets in a
.env.localfile and accessing them viaprocess.env. This prevents hardcoding credentials in the source code. - [EXTERNAL_DOWNLOADS]: All network requests and external links target official Hootsuite domains (
platform.hootsuite.com,developer.hootsuite.com) or well-known development tools (vitest.dev), which are trusted and relevant to the skill's stated purpose. - [COMMAND_EXECUTION]: While the skill's configuration allows for
npmandpnpmbash commands, the instructions themselves do not contain any arbitrary or dangerous command execution strings. The provided project structure and code are typical for a Node.js/TypeScript development environment. - [INDIRECT_PROMPT_INJECTION]: The skill serves as a static template for developers and does not ingest or process untrusted external data, posing no significant risk of indirect prompt injection.
Audit Metadata