taruvi-refine-providers
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructions include installing official vendor packages (
@taruvi/refine-providers,@taruvi/sdk) and the well-known Refine framework (@refinedev/core) via standard package managers. These are legitimate dependencies for the development tasks described. - [CREDENTIALS_UNSAFE]: The skill follows security best practices by instructing developers to use framework-specific environment variable prefixes (e.g.,
VITE_TARUVI_API_KEY) for sensitive application configuration rather than hardcoding secrets directly in the source code. - [INDIRECT_PROMPT_INJECTION]: The skill facilitates building frontend interfaces that display data from external databases and storage buckets. While this represents a data ingestion surface common to all frontend development, the skill utilizes standard Refine.dev hooks which operate within a structured data context, minimizing the risk of unauthorized instruction execution through processed content.
- [DATA_EXPOSURE]: The documentation describes the use of an
appDataProviderto fetch application settings and secrets. While fetching sensitive keys to a frontend environment requires careful platform-side access control, the skill itself neutrally documents the intended functionality of the vendor's SDK for authorized application management.
Audit Metadata