genesis-auth
Pass
Audited by Gen Agent Trust Hub on Oct 25, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill implements several high-standard security controls: passwords are validated against bcrypt's 72-byte limit and hashed appropriately; session and reset tokens are stored as SHA-256 hashes to prevent retrieval from the database; cookies are strictly configured with HttpOnly, Secure, and SameSite=Lax/Strict attributes; and mutations are protected by Origin checks to mitigate CSRF risks.
- [INDIRECT_PROMPT_INJECTION]: The skill reads and adapts to the target project's existing code and configuration, which creates a theoretical surface for indirect prompt injection. This is a standard characteristic of code-generation tools and is mitigated by the skill's prescriptive security rules.
- Ingestion points: Reads project files such as internal/db/migrations, internal/api/http/handler, and project configuration files.
- Boundary markers: The instructions do not define specific delimiters for the project code being ingested.
- Capability inventory: The skill has the ability to write new Go source files, migration scripts, and execute build-time commands such as 'make generate' and 'go mod tidy'.
- Sanitization: The skill relies on its internal logic to enforce secure coding patterns rather than blindly copying untrusted project content.
Audit Metadata