builder
Pass
Audited by Gen Agent Trust Hub on Oct 11, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is a comprehensive development assistant focused on production-grade code quality and security. It provides extensive guidance for building type-safe systems across multiple languages (TypeScript, Go, Python, Rust, Kotlin, Swift).
- [PROMPT_INJECTION]: No malicious prompt injection patterns were detected. Static analysis hints regarding action concealment in the CLI design reference were found to be defensive UX guidelines advising developers how to avoid building confusing or opaque command-line tools.
- [DATA_EXFILTRATION]: No evidence of data exfiltration was identified. The skill enforces the externalization of secrets and provides secure patterns for third-party API authentication (e.g., Stripe, GitHub) and webhook signature verification using timing-safe comparisons.
- [EXTERNAL_DOWNLOADS]: The skill references standard, well-known libraries for its primary functions, such as
google-genaifor image processing andzodfor validation. It explicitly includes 'Slopsquat Awareness' documentation to teach the agent and user how to detect and avoid malicious package impersonation (typosquatting). - [INDIRECT_PROMPT_INJECTION]: The skill identifies ingestion surfaces and provides robust architectural patterns to mitigate injection risks, such as enforcing 'parse, don't validate' principles at all system boundaries and utilizing branded types to prevent type confusion.
Audit Metadata