resource-best-practices
Pass
Audited by Gen Agent Trust Hub on Oct 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill promotes the use of parameterized SQL queries via oxmysql to prevent SQL injection vulnerabilities.
- [SAFE]: It provides guidance on secure credential management, advising developers to use server-side configuration variables (convars) instead of hardcoding secrets in source files.
- [SAFE]: The instructions include critical patterns for preventing privilege escalation and unauthorized entity manipulation by enforcing server-side ownership and validation for networked entities.
- [SAFE]: It addresses potential context-leakage vulnerabilities by instructing developers to immediately capture the source variable in asynchronous server-side event handlers.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to analyze and modify user-provided code files, creating a potential surface for indirect prompt injection.
- Ingestion points: Files matching **/.lua, **/.ts, and **/*.js as defined in SKILL.md.
- Boundary markers: None explicitly defined in the instructions for separating user code from agent instructions.
- Capability inventory: The skill allows the agent to read, write, and review code scripts as defined in SKILL.md.
- Sanitization: No specific sanitization or escaping of the user-provided code is mentioned before processing.
Audit Metadata