api-cms-payload
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill serves as a developer guide for Payload CMS, emphasizing security best practices such as mandatory access control, the use of environment variables for secrets, and type-safe API operations.
- [REMOTE_CODE_EXECUTION]: The documentation mentions
npx create-payload-app@latest, which is the standard and official scaffolding tool for initializing Payload CMS projects. - [CREDENTIALS_UNSAFE]: The skill includes a 'Bad Example' code block containing dummy credentials (
postgres://user:pass@localhost/mydb) to explicitly illustrate insecure coding practices and reinforce the importance of secret management. - [EXTERNAL_DOWNLOADS]: References official framework packages from the
@payloadcmsnamespace on NPM, which is standard for building applications with this CMS.
Audit Metadata