auth-system-setup
Pass
Audited by Gen Agent Trust Hub on Oct 31, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill instructions promote high-security standards for web application development, specifically following RFC best practices for OAuth 2.0 and session management.
- [EXTERNAL_DOWNLOADS]: The skill references standard endpoints for well-known services (Google OAuth) and a vendor-owned domain (
app.terminalskills.io) for callback redirection. These are functional requirements for the skill's purpose and originate from the author's infrastructure or trusted providers. - [INDIRECT_PROMPT_INJECTION]: The skill facilitates the processing of user requirements to generate authentication code.
- Ingestion points: User-provided tech stack, roles, and auth methods described in
SKILL.md. - Boundary markers: None explicitly defined in the instructions.
- Capability inventory: Text-based code generation for backend frameworks and SQL migrations. The skill does not possess autonomous execution capabilities like file system writes or network requests outside the standard LLM generation context.
- Sanitization: Not applicable as the skill provides instructions for the model's logic rather than executing data-driven scripts.
- [CREDENTIALS_UNSAFE]: The skill correctly instructs the user to use environment variables for sensitive data (e.g.,
GOOGLE_CLIENT_ID) and includes a clear warning against storing plain-text passwords or sensitive data in JWT payloads.
Audit Metadata