using-web-backend
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [SAFE]: The skill provides purely instructional content for backend engineering best practices. It does not contain executable code, sensitive data access, or network exfiltration patterns. The instructions explicitly advise keeping credentials out of logs, errors, and model-visible payloads.
- [INDIRECT_PROMPT_INJECTION]: The skill defines workflows where the agent inspects external data such as project routes, schemas, and manifests. This creates a surface for indirect prompt injection if an attacker can control those project files. However, the skill focuses on implementation and review guidance rather than granting the agent autonomous high-privilege capabilities, which limits the potential impact.
- [EXTERNAL_DOWNLOADS]: The skill provides links to official and well-known documentation for frameworks and standards, including Django, Express, FastAPI, OpenAPI, and GraphQL. These are reputable resources and do not involve runtime remote code execution or untrusted package installation.
Audit Metadata