writing-streamlit-apps
Pass
Audited by Gen Agent Trust Hub on Aug 3, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides documentation on secure development practices, specifically warning against HogQL (SQL) injection by advising developers to validate and coerce user inputs rather than using raw string interpolation in database queries.
- [SAFE]: The execution environment described is restricted to a specific set of pre-installed, well-known libraries (such as pandas, numpy, and streamlit) and explicitly prevents the installation of arbitrary packages via pip, reducing the risk of supply chain attacks.
- [SAFE]: The skill emphasizes the use of an 'in-sandbox bridge' (
posthog_apps.query()) for data access, which is pre-authenticated, ensuring that the AI agent and the resulting application do not handle or expose sensitive credentials like API tokens. - [SAFE]: Instructions include platform constraints such as ephemeral disk storage and unprivileged user execution, which align with security best practices for sandboxed runtimes.
Audit Metadata