building-data-apps
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs on building web applications that process user input via framework components like textboxes and sliders. While this creates a potential surface for indirect injection, the documentation includes a dedicated security checklist recommending input validation and authentication.
- Ingestion points: Data entered by users into web UI widgets in files like SKILL.md and framework-specific references.
- Boundary markers: The documentation includes a Security Checklist advising on input validation and authentication.
- Capability inventory: Frameworks have access to environment variables, network operations, and file system access.
- Sanitization: The skill explicitly recommends input validation as a deployment best practice.
- [COMMAND_EXECUTION]: The deployment documentation includes standard Linux administrative commands for installing packages and configuring system services (systemd, Nginx) on production servers.
- [CREDENTIALS_UNSAFE]: The documentation provides explicit guidance against hardcoding sensitive information, demonstrating the use of environment variables and framework-specific secret management tools to handle API keys safely.
Audit Metadata