skills/assistant-ui/skills/cloud/Gen Agent Trust Hub

cloud

Pass

Audited by Gen Agent Trust Hub on Sep 14, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONCREDENTIALS_UNSAFE
Full Analysis
  • [COMMAND_EXECUTION]: The documentation provides standard npm install instructions for the required libraries and their peer dependencies.
  • [EXTERNAL_DOWNLOADS]: The skill references several Node.js packages from the @assistant-ui namespace and other well-known authentication and database providers such as Clerk, Auth0, Supabase, Firebase, and Drizzle.
  • [DATA_EXFILTRATION]: The skill incorporates a telemetry feature via cloud.runs.report, which transmits run metadata (e.g., token usage, model identifiers, step counts) to the assistant-api.com backend. The documentation explicitly clarifies that message content is not transmitted in these reports and provides a telemetry: false configuration to disable the feature entirely.
  • [CREDENTIALS_UNSAFE]: The documentation mentions the ASSISTANT_API_KEY for server-side authentication. It correctly identifies this as a sensitive secret, providing explicit warnings to never expose it to client-side code and recommending the use of environment variables for secure storage.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 14, 2026, 07:05 PM
Security Audit — agent-trust-hub — cloud