start-core/middleware
Pass
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is a technical guide that promotes secure coding practices. It includes 'CRITICAL' warnings for developers about not trusting client-sent identifiers (IDOR prevention) and properly separating validation from authorization.
- [PROMPT_INJECTION]: No malicious instruction overrides, jailbreak attempts, or system prompt extraction patterns were detected.
- [DATA_EXPOSURE_AND_EXFILTRATION]: No hardcoded credentials, sensitive file access, or unauthorized network exfiltration patterns were found. Examples use placeholders like
getToken(). - [UNVERIFIABLE_DEPENDENCIES_AND_RCE]: The skill references standard, versioned packages from the TanStack ecosystem. No remote code execution or suspicious package installation commands are present.
- [INDIRECT_PROMPT_INJECTION]: While the skill describes processing client-provided data (
sendContext), it provides explicit sanitization and boundary-checking instructions (Layer 3 correctness) to mitigate injection and authorization bypass risks.
Audit Metadata