spree-auth-permissions
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill documents standard authorization patterns including role-based access control (RBAC) and ownership-based access control policies. It correctly distinguishes between staff, integration, and customer access levels.
- [SAFE]: Security best practices are consistently applied in the examples, such as recommending environment variables for sensitive credentials (e.g., ENTRA_CLIENT_SECRET, JWT_SECRET_KEY) rather than hardcoding them.
- [SAFE]: The skill provides critical security guidance for custom implementations, such as warning against linking accounts on unverified emails to prevent account takeover and recommending the use of Spree::Authentication::Lockout for all password-checking logic.
- [INDIRECT_PROMPT_INJECTION]: The skill describes the processing of external authentication data and role management. While this constitutes a data ingestion surface, the documentation includes necessary security controls such as encryption at rest for tokens and strict scoping requirements. Ingestion points include API auth endpoints and identity provider tokens, with capabilities managed through role assignment and scope registration, and sanitization implemented via lockout checks and email verification requirements.
Audit Metadata