insecure-deserialization
Pass
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill serves as a security reference for OWASP A08 (Insecure Deserialization). It contains code snippets illustrating common vulnerabilities in Python, Java, PHP, Node.js, Ruby, and .NET.
- [SAFE]: All dangerous code examples are explicitly labeled as 'VULNERABLE' and include comments explaining the risk (e.g., 'RCE possible!').
- [SAFE]: The skill provides practical 'SAFE' implementations, such as using
json.loadsinstead ofpickle.loadsin Python, usingSafeLoaderfor YAML, implementing HMAC signing for integrity, and using allowlists for class deserialization in Java and PHP. - [SAFE]: The JavaScript section correctly identifies and provides mitigations for prototype pollution, including using
Object.create(null)and freezingObject.prototype. - [SAFE]: No active code execution, network exfiltration, or prompt injection patterns were detected. The skill instructions focus on educating the agent on how to assist users with secure coding practices.
Audit Metadata