rudder-ai-events-instrument
Pass
Audited by Gen Agent Trust Hub on Oct 28, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill utilizes official vendor-owned SDKs and packages including
@rudderstack/ai(Node.js),rudderstack-ai(Python), andgithub.com/rudderlabs/ai-sdk-go(Go). All referenced resources are consistent with the skill author 'rudderlabs'. - [SAFE]: Secret management practices are secure. The instructions explicitly forbid hardcoding write keys or API tokens, directing the use of environment variables instead.
- [SAFE]: The skill includes a robust 'Handling External Content' section that instructs the agent to treat the target application's code and prompts as untrusted data and specifically warns against following any instructions found within them (mitigating Indirect Prompt Injection).
- [SAFE]: Input validation is emphasized, such as requiring browser-sent interaction IDs to be validated as UUIDs before use.
- [SAFE]: Supply chain security is addressed by mandating exact version pins for dependencies and prohibiting the execution of arbitrary scripts from package documentation or post-install hooks.
Audit Metadata