app-health-check
Pass
Audited by Gen Agent Trust Hub on Nov 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill interacts exclusively with the official Meta developer platform via the
devtoolsMCP server atmcp.facebook.com. Both the author and the service provider belong to a trusted organization. - [SAFE]: The instructions include clear security guardrails, specifically directing the agent to never ask for user access tokens and instead leverage the established OAuth flow.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data retrieved from API calls (e.g., app settings, compliance status, and API usage). While this represents a potential surface for indirect prompt injection if an attacker-controlled app field contains malicious instructions, the risk is low as the data is consumed from a trusted platform and used to generate a structured report rather than being executed.
- [SAFE]: References to external repositories for setup (e.g.,
facebook/agentic-tools) point to verified organizations and well-known services.
Audit Metadata