party-skill
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements core logic through official WeChat Cloud Functions (wx-server-sdk), adhering to standard development practices for the platform.
- [SAFE]: Sensitive data operations, such as creating or retrieving party details, are properly scoped to the authenticated user's openid, preventing unauthorized access to other users' data.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user input (e.g., party titles) and interpolates it into success messages. While this is an attack surface, the risk is mitigated by openid-based data isolation and the nature of the skill's primary purpose.
- [SAFE]: No hardcoded credentials, malicious network redirects, or suspicious external dependencies were found. Mock data in seed.js contains properly masked telephone numbers.
- [SAFE]: The skill uses structured data for its components and clear instructional boundaries in its MCP metadata.
Audit Metadata