Truto Link SDK
Pass
Audited by Gen Agent Trust Hub on Jul 29, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill documents the official Truto Link SDK for frontend integrations, including authentication flows and cloud file pickers.
- [EXTERNAL_DOWNLOADS]: The skill instructs users to install the
@truto/truto-link-sdkpackage from npm. This package is a standard library maintained by the vendor trutohq. - [DATA_EXFILTRATION]: The skill provides backend code examples that use environment variables (
process.env.TRUTO_API_TOKEN) to manage secrets and communicate with official vendor domains (api.truto.one). This architecture ensures that sensitive credentials are not exposed to the browser, adhering to security best practices. - [PROMPT_INJECTION]: While the skill involves processing external data such as link tokens and JSONata expressions (
trutoExpression), these are used within the defined scope of the SDK for account connection and data transformation, presenting a low risk of indirect prompt injection.
Audit Metadata