upstash-qstash
Pass
Audited by Gen Agent Trust Hub on Jun 23, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides documentation and code patterns for using Upstash QStash, a well-known message queue service. All code snippets follow industry standard security practices.
- [DATA_EXPOSURE]: The skill explicitly warns against hardcoding secrets (Severity: SAFE). It correctly instructs the user to use environment variables like
process.env.QSTASH_TOKENandprocess.env.QSTASH_CURRENT_SIGNING_KEYfor configuration. - [INDIRECT_PROMPT_INJECTION]: The skill discusses handling external webhooks, which is a potential entry point for untrusted data. It mitigates this by making signature verification a central requirement.
- Ingestion points: Webhook routes documented in
SKILL.md(e.g.,/api/webhook/route.ts). - Boundary markers: Uses the
@upstash/qstashReceiverclass for mandatory signature verification before processing payloads. - Capability inventory: Includes network publishing (
qstash.publishJSON) and database interaction examples. - Sanitization: Demonstrates safe extraction of the raw request body and subsequent JSON parsing only after successful verification.
Audit Metadata