app-studio-pro-code
Pass
Audited by Gen Agent Trust Hub on Apr 12, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to fetch necessary frontend libraries including React, Recharts, and Chart.js from well-known and trusted content delivery networks (CDNs) such as unpkg.com, esm.sh, and jsdelivr.net. These references are used for standard application functionality.
- [COMMAND_EXECUTION]: Instructions include the use of the 'domo publish' CLI tool and standard 'npm run build' commands. These are documented as part of the intended development workflow for deploying custom apps to the Domo platform.
- [DATA_EXFILTRATION]: While the skill demonstrates how to use API tokens and session identifiers (SID) for authenticating with Domo's official endpoints (e.g., instance.domo.com), these operations are limited to the vendor's own infrastructure and are necessary for the skill's primary purpose. No evidence of unauthorized data transfer to third-party domains was found.
- [INDIRECT_PROMPT_INJECTION]: The skill defines patterns for listening to external data inputs via 'domo.onFiltersUpdated' and 'domo.onVariablesUpdated'. It mitigates risks associated with untrusted data by providing templates that use explicit mapping tables (whitelisting) to translate display labels into internal application values before they are used in data queries.
Audit Metadata