knock-in-app-ui
Pass
Audited by Gen Agent Trust Hub on Jul 13, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to use the official
knockCLI tool for environment and channel discovery. These commands (e.g.,knock whoami,knock channel list,knock guide list) are standard developer operations for the Knock platform and do not involve arbitrary or dangerous command execution. - [CREDENTIALS_UNSAFE]: The skill follows security best practices by explicitly instructing users to use public API keys (
pk_...) for client-side code and warning against the use of secret keys. It also correctly advises storing configuration in environment variables. - [EXTERNAL_DOWNLOADS]: The skill references the official
@knocklabs/reactpackage via standard package managers (npm). These are trusted vendor resources for this skill. - [PROMPT_INJECTION]: No evidence of prompt injection, role-play, or safety bypass attempts was found. The instructions use natural technical language to guide the agent's behavior for developer support.
Audit Metadata