multi-tenant-architecture
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: References official SDKs such as
@vercel/sdkand@vercel/global-config, and documentation from trusted organizations like Vercel, Cloudflare, and Neon. These are used for standard platform integration. - [COMMAND_EXECUTION]: Includes
curl,psql, andrgcommands in a validation checklist. These are intended for developers to verify the security of their own deployments (e.g., checking for 404s on unknown hosts or testing RLS policies). - [INDIRECT_PROMPT_INJECTION]: The skill guides the creation of platforms that process untrusted hostname and header data. It explicitly addresses the risk of header spoofing and provides architectural mitigations, including stripping inbound
x-tenant-*headers and enforcing Row Level Security (RLS) in the database layer. - [DYNAMIC_EXECUTION]: Describes the implementation of Cloudflare Workers for Platforms, which involves dynamic execution of tenant scripts. The instructions emphasize the use of 'untrusted' isolation mode and per-invocation resource limits to maintain security boundaries.
Audit Metadata