setup-saaskit
Pass
Audited by Gen Agent Trust Hub on Nov 4, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of official Scalekit SDKs, specifically
@scalekit-sdk/nodefor Node.js projects andscalekit-sdk-pythonfor Python projects. These are verified vendor resources. - [COMMAND_EXECUTION]: The skill suggests using the
@scalekit-inc/clivianpxfor automated setup tasks, which is a standard deployment tool provided by the author. - [INDIRECT_PROMPT_INJECTION]: The skill ingests configuration data (API credentials and environment URLs) provided by the user from the Scalekit dashboard. While no explicit boundary markers are defined for this data ingestion, the risk is mitigated by the skill's specific purpose of local project configuration. The available capability surface includes writing to local environment files and managing package installations.
- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill follows secure credential management practices by instructing the user to store sensitive API secrets in
.envfiles, keeping them out of the version-controlled source code.
Audit Metadata