sota-identity-access
Pass
Audited by Gen Agent Trust Hub on Jun 17, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is purely instructional and provides security guidelines for Identity and Access Management (IAM). It contains no executable malicious scripts, obfuscation, or data exfiltration logic.
- [EXTERNAL_DOWNLOADS]: The skill references several well-known and trusted technology organizations and standards bodies, including NIST (800-63-4), IETF (multiple RFCs for OIDC/OAuth), and CNCF-hosted projects such as OPA (Open Policy Agent) and OpenFGA. These references are used for educational and documentation purposes.
- [COMMAND_EXECUTION]: The skill includes documentation for CLI tools related to identity providers, such as 'kanidm' and 'kanidmd'. These are provided as usage examples for legitimate identity infrastructure management and do not involve unauthorized command execution.
- [DATA_EXFILTRATION]: There are no patterns suggesting data exfiltration. Placeholders used in code examples (e.g., 'SVC_API_KEY') are used specifically to illustrate insecure practices (hardcoded keys) that the skill instructs users to avoid.
- [PROMPT_INJECTION]: The skill contains instructional language for the AI agent to follow BUILD and AUDIT modes. These instructions are consistent with the skill's stated purpose and do not attempt to bypass safety guidelines or override system prompts.
Audit Metadata