velt-approval-engine-best-practices
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill consists of technical documentation for integrating with the Velt Approval Engine. It correctly identifies the author as 'velt-js' and all external resources, such as 'api.velt.dev' and 'docs.velt.dev', are official vendor domains.- [SAFE]: The documentation actively promotes secure implementation patterns, including mandatory HMAC-SHA256 signature verification for webhooks to prevent spoofing and the use of idempotency keys to ensure reliable request processing.- [SAFE]: The skill describes a declarative workflow model where logic expressions are compiled into an AST at write-time and walked at runtime, which is a safer alternative to dynamic execution methods like 'eval'.- [SAFE]: The documentation includes important security disclosures, such as noting that the engine does not automatically verify reviewer identities and advising developers to implement their own application-level authorization checks.- [SAFE]: No obfuscation, prompt injection attempts, or unauthorized data exfiltration patterns were found in the provided files.
Audit Metadata