skills/konglong87/xuanxue-skills/palm/Gen Agent Trust Hub

palm

Pass

Audited by Gen Agent Trust Hub on Oct 10, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill implements a 'Contract' pattern in lib/contract.js that deterministically validates all visual observations against a frozen allowlist of visual traits and interpretation codes, preventing hallucinations and ensuring safety compliance.
  • [SAFE]: Health assessments are strictly limited to two non-medical interpretation codes (energy-stable, energy-variable) and are accompanied by a mandatory, hardcoded disclaimer to prevent unauthorized medical advice.
  • [SAFE]: The skill implementation mitigates indirect prompt injection risks by ensuring the model cannot directly output results to the user; all data must pass through the contract script, which generates a sanitized report using pre-defined dictionary entries.
  • [SAFE]: Potential data exfiltration via observation metadata (such as 'source' URLs) is blocked because the contract strips this information during the report rendering phase.
  • [SAFE]: The codebase utilizes deepFreeze on all configuration and rule objects, protecting the validation logic from runtime tampering or accidental modification.
  • [SAFE]: Extensive unit testing in __tests__/contract.test.js confirms that the safety gates correctly reject conflicting traits, incomplete evidence, and unauthorized interpretation codes.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 10, 2026, 09:13 AM