live-chat-support-weapon
Pass
Audited by Gen Agent Trust Hub on Jul 25, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides detailed implementation guides for securing user identity using HMAC-SHA256 and JWT signatures. It emphasizes that signing must occur in server-side environments (e.g., Next.js API Routes or Server Actions) to prevent exposing private keys to the client.
- [SAFE]: All code examples correctly use environment variable placeholders (e.g., 'CRISP_SECRET_KEY', 'INTERCOM_SECRET_KEY') and explicitly warn against hardcoding secrets in client-side bundles or version control.
- [SAFE]: The integration patterns for third-party widgets (Intercom, Crisp) follow official documentation and utilize standard asynchronous loading methods.
- [SAFE]: The skill includes critical security headers, specifically 'Cache-Control: no-store', to prevent identity tokens from being cached by intermediaries or served to incorrect users.
- [SAFE]: No suspicious command execution, obfuscation, or persistence mechanisms were detected. The skill's primary focus is providing defensive coding standards and platform selection guidance.
Audit Metadata