miro-hello-world
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides standard TypeScript examples for Miro board operations, focusing on educational and quick-start purposes.
- [DATA_EXPOSURE_EXFILTRATION]: The code snippets correctly demonstrate the use of
process.env.MIRO_ACCESS_TOKENfor authentication. This follows secret management best practices by avoiding hardcoded credentials. - [INDIRECT_PROMPT_INJECTION]: The
listBoardItemsfunction ingests data from external Miro boards. While this provides a surface for untrusted content to enter the agent context, the skill handles it safely by only logging the content to the console without performing dangerous follow-up actions like command execution or file writes based on that data. - [EXTERNAL_DOWNLOADS]: The skill references the official
@mirohq/miro-apipackage and standard Miro API endpoints (api.miro.com), which are well-known and trusted for this integration context.
Audit Metadata