findy-hackathon

Pass

Audited by Gen Agent Trust Hub on Aug 8, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill facilitates project initialization by downloading templates from the author's GitHub repository (yusukebe/findy-campus-hackathon-02) using the degit tool. It also suggests adding additional skills from the author's collection.
  • [COMMAND_EXECUTION]: Instructs the user to run standard development commands such as npm install, npm run dev, and wrangler deploy. These are typical for the described project workflow.
  • [SAFE]: The skill demonstrates strong security awareness by explicitly instructing users not to hardcode credentials. It provides guidance on using wrangler secret put for production environments and .dev.vars for local development, emphasizing the importance of .gitignore to prevent secret leakage.
  • [PROMPT_INJECTION]: As a meta-skill for building AI applications, it describes an attack surface for Indirect Prompt Injection (Category 8) in the resulting applications (e.g., chat agents processing user input).
  • Ingestion points: AIChatAgent and useAgentChat interfaces described in the skill recipes (SKILL.md).
  • Boundary markers: Not explicitly defined in this orchestration skill, but it refers users to the agents-sdk skill for implementation details.
  • Capability inventory: The resulting applications may include tool calling and database access (D1, R2, Durable Objects).
  • Sanitization: Standard validation is encouraged via the referenced hono and cloudflare best-practice skills.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 8, 2026, 02:55 AM
Security Audit — agent-trust-hub — findy-hackathon