security-review
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill files consist entirely of educational content, checklists, and code snippets demonstrating secure and insecure programming practices for development and infrastructure teams.
- [INDIRECT_PROMPT_INJECTION]: The skills are designed to assist in reviewing external code and user input handlers. While this involves processing untrusted data, the instructions prioritize establishing security boundaries and sanitization patterns.
- Ingestion points: SKILL.md (instructions for reviewing user input, file uploads, and code).
- Boundary markers: Present; the skill recommends using validation schemas (Zod), parameterized queries, and Row Level Security (RLS).
- Capability inventory: None; the skill provides instructions only and does not contain executable scripts or tool calls.
- Sanitization: Present; the skill explicitly instructs on the use of sanitization libraries like DOMPurify for HTML content.
- [CREDENTIALS_UNSAFE]: The documentation includes code examples with hardcoded secrets, but these are explicitly marked as negative examples to be avoided ("NEVER Do This") and use non-functional placeholder values (e.g., 'sk-proj-xxxxx', 'password123').
Audit Metadata