embed-portal
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The provided deployment documentation includes a standard Dockerfile with common build and execution commands (
npm ci,npm run build,npm start). These are standard lifecycle commands for a Node.js application. - [INDIRECT_PROMPT_INJECTION]: The skill generates an application that ingests external configuration data such as branding guidelines, dashboard metadata, and user filter rules.
- Ingestion points: Branding color/font placeholders in
tailwind.config.ts, dashboard names in the registry, and per-user filter definitions stored in Domo AppDB or external databases. - Boundary markers: The implementation uses server-side validation and role-based access control (RBAC) to ensure users only access their assigned data.
- Capability inventory: The resulting application performs network operations to Domo APIs and renders authenticated iframes for dashboard viewing.
- Sanitization: The skill follows security best practices by implementing password hashing with bcrypt, using environment variables for secrets, and enforcing filters server-side during the embed token request.
Audit Metadata