auth-nodejs-cloudbase
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to install the official
@cloudbase/node-sdkpackage via npm when it is not already available. This is a standard development practice for integrating with the intended service. - [CREDENTIALS_UNSAFE]: The skill provides clear guidance on managing sensitive credentials. It explicitly warns against hardcoding values, suggests using environment variables, and provides instructions for securely loading a private key file (
tcb_custom_login.json) for custom login flows, noting that it should never be bundled into frontend code. - [DATA_EXPOSURE]: The skill handles user identity information (UID, OpenID, custom IDs) but follows best practices by instructing the agent to use these for backend authorization decisions and logging caller IP addresses for security audits, without exfiltrating data to external domains.
- [INDIRECT_PROMPT_INJECTION]: The skill defines an attack surface by processing user-provided inputs like environment IDs and user identifiers. However, it mitigates risk by instructing the agent to perform explicit authorization checks, use trusted identifiers like UID over client-provided OpenIDs, and handle errors using standard patterns.
Audit Metadata