together-sdk-patterns

Pass

Audited by Gen Agent Trust Hub on Sep 10, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill implements security best practices by explicitly instructing the agent to keep the TOGETHER_API_KEY out of objects that may be logged or serialized.
  • [SAFE]: All external resources and links target official Together AI domains or their official GitHub organization. These are recognized as trusted services for the context of this skill.
  • [INDIRECT_PROMPT_INJECTION]: The skill operates on a user-provided repository path, which presents a surface for indirect prompt injection if malicious instructions are embedded in the target code. The risk is considered low and inherent to the skill's primary function as a developer tool.
  • Ingestion points: File content is ingested via Read, Glob, and Grep from the provided [repository-path] (SKILL.md).
  • Boundary markers: The instructions do not define specific delimiters or "ignore instructions" wrappers for the ingested code data.
  • Capability inventory: The skill utilizes Write and Edit for file system modifications and WebFetch for network access (SKILL.md).
  • Sanitization: No explicit content sanitization or validation steps are defined for the ingested repository data.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 10, 2026, 06:11 PM
Security Audit — agent-trust-hub — together-sdk-patterns