lucidchart-performance-tuning
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill demonstrates secure configuration practices by using environment variables (
LUCID_ACCESS_TOKEN,REDIS_URL) rather than hardcoding credentials. - [SAFE]: Network communication is scoped to the official Lucidchart API domain (
api.lucid.co), which is a well-known and established service. - [SAFE]: Dependencies listed in the code snippets (
ioredis,p-limit,undici,prom-client) are well-maintained, standard Node.js packages used for their intended purposes (caching, concurrency control, HTTP client, and monitoring). - [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of data from external Lucidchart API endpoints, which could theoretically contain malicious instructions if the document content is attacker-controlled.
- Ingestion points: Document and shape data retrieved via
lucidApi.getDocumentandlucidApi.getShapesinSKILL.md. - Boundary markers: None explicitly defined in the provided implementation examples.
- Capability inventory: Network access (fetch/undici) and database/cache access (Redis).
- Sanitization: No specific content sanitization or validation of the API payload is shown in the performance-focused snippets.
Audit Metadata