cloud-storage-web
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides comprehensive instructions for browser-side storage operations using the official
@cloudbase/js-sdklibrary. All external resource references (package names, URI schemes likecloud://, and management tool actions) are consistent with the official Tencent CloudBase ecosystem and the author's identity. - [DATA_EXPOSURE]: The skill explicitly advises against hardcoding credentials, instructing the agent to use
queryAppAuthto retrieve publishable keys and store them in.env.localfiles, which is a standard secure practice for frontend development. - [COMMAND_EXECUTION]: While the skill includes SQL templates for configuring PostgreSQL Row Level Security (RLS), these are provided as best-practice security configurations to protect storage objects. The use of the
managePgDatabasetool requires explicit user confirmation (confirm=true), mitigating the risk of unauthorized execution. - [INDIRECT_PROMPT_INJECTION]: The skill mentions handling external files (uploads). It includes safety recommendations such as validating file types and sizes before processing, and it correctly scopes the agent's actions to specific environment IDs and security domains.
Audit Metadata