drf-api-performance

Pass

Audited by Gen Agent Trust Hub on Sep 2, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to guide an agent through the process of writing, reviewing, and modifying Django REST Framework components based on external project requirements. This workflow creates a surface for indirect prompt injection where malicious instructions could be embedded in the code snippets or requirements being processed.
  • Ingestion points: The skill instructs the agent to add or change DRF viewsets, serializers, and querysets based on external context described in SKILL.md.
  • Boundary markers: There are no explicit instructions or delimiters defined to separate untrusted inputs from the agent's core instructions.
  • Capability inventory: The skill context involves modifying Python source files and executing testing/linting tools such as pytest and drf-lint.
  • Sanitization: No specific sanitization or validation logic for external code or data inputs is mentioned.
  • [EXTERNAL_DOWNLOADS]: The skill references several external libraries and utilities for performance profiling and code quality.
  • It suggests using django-prefetch and django-zeal from the public Python Package Index (PyPI).
  • It references mitol-drf-lint, a tool hosted in the vendor's official GitHub repository (github.com/mitodl/ol-django).
  • These downloads are for legitimate, established development tools and are documented neutrally in accordance with their intended use for performance optimization.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 2, 2026, 12:31 PM
Security Audit — agent-trust-hub — drf-api-performance