implement-sso
Pass
Audited by Gen Agent Trust Hub on Aug 28, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill recommends installing the
@scalekit-sdk/nodepackage. This is a verified library provided by the author (scalekit-inc) for the intended purpose of SSO integration. - [INDIRECT_PROMPT_INJECTION]: The skill defines logic that processes external data through URL query parameters, creating a potential surface for indirect prompt injection.
- Ingestion points: Data enters the application context via
req.queryin the login and callback handlers defined inSKILL.md(Steps 3, 4, and 5). - Boundary markers: Absent; the skill focuses on the functional implementation of the OAuth flow.
- Capability inventory: The code snippets in
SKILL.mdperform HTTP redirects and token-based authentication using the vendor's SDK. - Sanitization: The skill includes a mandatory sanitization step, requiring the application to call
validateTokenon the identity and access tokens before creating a user session.
Audit Metadata