implement-sso

Pass

Audited by Gen Agent Trust Hub on Aug 28, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill recommends installing the @scalekit-sdk/node package. This is a verified library provided by the author (scalekit-inc) for the intended purpose of SSO integration.
  • [INDIRECT_PROMPT_INJECTION]: The skill defines logic that processes external data through URL query parameters, creating a potential surface for indirect prompt injection.
  • Ingestion points: Data enters the application context via req.query in the login and callback handlers defined in SKILL.md (Steps 3, 4, and 5).
  • Boundary markers: Absent; the skill focuses on the functional implementation of the OAuth flow.
  • Capability inventory: The code snippets in SKILL.md perform HTTP redirects and token-based authentication using the vendor's SDK.
  • Sanitization: The skill includes a mandatory sanitization step, requiring the application to call validateToken on the identity and access tokens before creating a user session.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 28, 2026, 08:09 AM
Security Audit — agent-trust-hub — implement-sso