resonate-human-in-the-loop-pattern-typescript
Pass
Audited by Gen Agent Trust Hub on Aug 10, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [SAFE]: No security issues detected. The skill provides legitimate documentation and code examples for using the Resonate SDK.
- [EXTERNAL_DOWNLOADS]: The skill references the @resonatehq/sdk and express Node.js packages. These are standard, legitimate dependencies for the documented functionality and originate from the skill's vendor or well-known registries.
- [PROMPT_INJECTION]: The skill describes patterns for ingesting external human input (e.g., through Express route handlers) to resolve durable promises that control workflow logic. \n
- Ingestion points: Express route handlers in SKILL.md (e.g., /approve/:promiseId). \n
- Boundary markers: Data is handled via durable promises with typed responses. \n
- Capability inventory: Resolved data influences workflow logic, triggering actions through ctx.run() and ctx.rpc(). \n
- Sanitization: Examples demonstrate sanitization by checking inputs against fixed values (e.g., action === 'accept').
Audit Metadata