make-app-group
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill defines defensive practices for constructing backend filter expressions (CEL) from user-selected group paths.
- Ingestion points: User-selected group path values processed in
references/group-filter-expression.md. - Boundary markers: Mandatory use of JSON string literals and strict DNF (Disjunctive Normal Form) structure to prevent expression manipulation.
- Capability inventory: Data retrieval through authenticated Service routes like
/api/entities/:entityKey/record-groups. - Sanitization: Rejection of complex data types and implementation of safe literal formatting helpers.
- [DATA_EXFILTRATION]: The skill incorporates robust logging requirements in
references/service-contract.mdandreferences/preset-and-data-flow.md, explicitly prohibiting the logging of sensitive information such as cookies, tokens, authorization headers, and full record payloads to prevent accidental data exposure. - [EXTERNAL_DOWNLOADS]: The instructions require the installation of
@qfei-design/make-app-groupand@qfei-design/canvas-table, which are vendor-controlled resources belonging to the author.
Audit Metadata