cloud
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONCREDENTIALS_UNSAFE
Full Analysis
- [COMMAND_EXECUTION]: The documentation provides standard
npm installinstructions for the required libraries and their peer dependencies. - [EXTERNAL_DOWNLOADS]: The skill references several Node.js packages from the
@assistant-uinamespace and other well-known authentication and database providers such as Clerk, Auth0, Supabase, Firebase, and Drizzle. - [DATA_EXFILTRATION]: The skill incorporates a telemetry feature via
cloud.runs.report, which transmits run metadata (e.g., token usage, model identifiers, step counts) to theassistant-api.combackend. The documentation explicitly clarifies that message content is not transmitted in these reports and provides atelemetry: falseconfiguration to disable the feature entirely. - [CREDENTIALS_UNSAFE]: The documentation mentions the
ASSISTANT_API_KEYfor server-side authentication. It correctly identifies this as a sensitive secret, providing explicit warnings to never expose it to client-side code and recommending the use of environment variables for secure storage.
Audit Metadata