make-app-actions
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill manages dependencies on
@qfei-design/packages, which are legitimate vendor-scoped libraries provided by the author for table and record management functionalities.\n- [INDIRECT_PROMPT_INJECTION]: The skill handles potentially untrusted record data during batch editing and deletion workflows. It mitigates injection risks by enforcing a strict validation architecture and authoritative backend checks.\n - Ingestion points: Untrusted data enters the system through record queries and bulk mutation request bodies (
/api/make/app/entities/:objectKey/records/bulk).\n - Boundary markers: The instructions mandate the creation of immutable operation snapshots and the use of monotonic generation tokens to prevent race conditions or stale data processing during asynchronous workflows.\n
- Capability inventory: The skill facilitates authorized network requests to Make Service endpoints and manages the UI lifecycle for record-level actions.\n
- Sanitization: Guidelines require strict JSON target parsing, lossless arbitrary-precision decoding for record IDs (to prevent numeric coercion errors), and mandatory server-side permission prechecks (
record-write-permission) prior to any mutation or deletion.
Audit Metadata