msgspec
Pass
Audited by Gen Agent Trust Hub on Jul 25, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill documents methods for ingesting and processing untrusted data from external sources via JSON and MessagePack decoding.
- Ingestion points: Processes external payloads through msgspec.json.decode, msgspec.msgpack.decode, and msgspec.convert as shown in SKILL.md.
- Boundary markers: Recommends the use of forbid_unknown_fields=True in SKILL.md to define data boundaries.
- Capability inventory: Provides serialization and validation capabilities for structured data; no direct shell or network capabilities are defined within the skill scripts.
- Sanitization: Promotes the use of msgspec.Meta for input validation, including regex patterns and range checks in references/constraints.md.
- [COMMAND_EXECUTION]: The skill includes instructions for dynamic type generation using msgspec.defstruct.
- Evidence: SKILL.md demonstrates creating DynamicModel and FlexModel at runtime based on dynamic field definitions.
Audit Metadata