spmi-auditor
Pass
Audited by Gen Agent Trust Hub on Aug 3, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill instructions emphasize security best practices, including using standard OAuth 2.1/PKCE flows and forbidding the request or storage of raw bearer tokens within the chat context.
- [SAFE]: The execution logic implements strict authorization checks, requiring the agent to verify the user's role and tenant access via a specific discovery tool (
spmi_get_my_access_context) before performing any domain-specific operations. - [SAFE]: User oversight is mandated for state-changing operations, requiring explicit approval and display of intended changes before executing document submissions or validations.
- [SAFE]: The skill lacks any code execution, remote downloads, or obfuscation techniques, relying entirely on defined MCP tool calls for its functionality.
Audit Metadata