file-uploads-and-storage
Pass
Audited by Gen Agent Trust Hub on Jun 18, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill demonstrates and encourages several security best practices for cloud file storage. Specifically:
- Input Validation: It uses the
zodlibrary to strictly enforce an allowlist of MIME types, maximum filename lengths, and file size limits (10MB cap) before generating upload tokens. - Tenant Isolation: Object keys are dynamically generated using a combination of a validated organization ID and a cryptographically secure UUID, preventing cross-tenant data access or object overwriting.
- Least Privilege: The implementation uses short-lived (60 seconds) presigned URLs for uploads and recommends private buckets with signed GET URLs for downloads, ensuring files are not publicly accessible by default.
- Infrastructure Protection: By promoting direct-to-storage uploads, it avoids common server-side vulnerabilities such as Denial of Service (DoS) via disk/memory exhaustion or bypassing serverless payload limits.
Audit Metadata