manufacturing-app-recipe
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill uses environment variables for sensitive credentials (InfluxDB, Grafana, Hugging Face tokens) and provides instructions for managing them securely via
.envfiles. - [EXTERNAL_DOWNLOADS]: The skill facilitates downloading official Docker images from Docker Hub and ghcr.io, as well as pre-trained AI models from Hugging Face. These are well-known and reputable services.
- [INDIRECT_PROMPT_INJECTION]: The skill acknowledges the risk of injection through untrusted data sources. Specifically, it warns about InfluxQL injection in the generated API code and instructs on the use of regex-based allowlists to sanitize user-supplied query parameters.
- [DYNAMIC_EXECUTION]: As an application generator, the skill produces Python scripts and configuration files that are executed within containerized environments. This is the primary intended function of the scaffold.
- [PRIVILEGE_ESCALATION]: The deployment configuration requires specific hardware access for GPU and NPU acceleration. It utilizes standard Linux device mounts and group memberships (video/render) to enable hardware-accelerated inference, which is a legitimate requirement for the use case.
Audit Metadata