agent-native-framework
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The documentation provides instructions to install the framework using
npx @agent-native/core@latest. This is a vendor-owned resource used for project initialization and skill management. - [COMMAND_EXECUTION]: The skill includes instructions for running various CLI commands such as
npx,pnpm, andcurlto manage the application lifecycle and test API endpoints. These are standard development operations for the intended use case. - [INDIRECT_PROMPT_INJECTION]: The framework is designed to build agents that process external data sources like emails and web search results, which represents a potential indirect prompt injection surface. The skill proactively addresses this by demonstrating the use of Zod for schema validation and implementing authentication checks within action definitions.
- [CREDENTIALS_SAFE]: The code examples correctly demonstrate using environment variables (e.g.,
process.env.DATABASE_URL,process.env.OPENAI_API_KEY) for secret management rather than hardcoding sensitive credentials. Placeholders used in.envexamples are clearly non-functional templates.
Audit Metadata