security-practices
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill provides patterns for handling untrusted data from web request bodies, parameters, and queries. While these are potential injection vectors, the skill explicitly provides mitigation evidence through strict schema validation with zod, HTML sanitization with DOMPurify, and the use of parameterized database queries to ensure data is handled safely.
- [COMMAND_EXECUTION]: The instructions contrast insecure shell command execution via exec() with secure alternatives using execFile() and argument arrays. This documentation helps prevent command injection vulnerabilities in the agent's generated code.
- [CREDENTIALS_UNSAFE]: The skill includes a .env.example file and code references to environment variables. These follow security best practices by using generic placeholders (e.g., user:password, sk_test_xxx) and instructing users to never commit actual secrets to version control.
Audit Metadata