skills/shinyorg/skills/shiny-actors/Gen Agent Trust Hub

shiny-actors

Pass

Audited by Gen Agent Trust Hub on Nov 6, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill framework facilitates processing untrusted data through multiple ingestion vectors as described in SKILL.md.
  • Ingestion points: Remote HTTP actor calls via ServeOverHttp, mDNS peer discovery data through UseDiscovery, and durable event streams via IActorStream.
  • Boundary markers: The documentation provides explicit patterns for defining authorizationPolicies and using Expose<T> callbacks to validate callers and filter access to actor methods.
  • Capability inventory: Actor implementations can perform persistent state writes using WriteStateAsync and AutoSave, which could be influenced by malicious inputs if not properly authorized.
  • Sanitization: The skill mandates the use of JsonSerializerContext for source-generated, typed serialization, which mitigates risks associated with unsafe reflection-based deserialization.
  • [EXTERNAL_DOWNLOADS]: The documentation references official framework packages available via NuGet, such as Shiny.Actors.DocumentDb and Shiny.Actors.HttpServer, for extending framework functionality.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 6, 2026, 12:36 AM