resonate-saga-pattern-typescript
Pass
Audited by Gen Agent Trust Hub on Aug 10, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [SAFE]: No security issues were detected. The skill contains architectural guidance and TypeScript code examples for coordinating distributed transactions using the Resonate SDK. The logic follows best practices for idempotency and error handling in distributed systems.
- [PROMPT_INJECTION]: The skill defines patterns for processing external data (e.g., orders and transaction IDs), which constitutes an indirect prompt injection attack surface. 1. Ingestion points: Function arguments such as
orderIdandOrderobjects insagaWorkflow,genericSaga, andprocessOrderSagawithinSKILL.md. 2. Boundary markers: The provided code examples do not include delimiters or specific instructions to the agent to ignore embedded commands within the processed data. 3. Capability inventory: The demonstrated code includes capabilities for remote procedure calls (ctx.rpc), database writes, and external service interactions (ctx.run) across all implementation variants. 4. Sanitization: Standard application-level validation (e.g., checking order totals) is demonstrated, but no specific sanitization or filtering for AI-interpreted content is included.
Audit Metadata