gleam-practice
Pass
Audited by Gen Agent Trust Hub on Apr 20, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill serves as a best-practice repository for Gleam developers, providing templates and architectural guidance for building web services on the Erlang target.
- [CREDENTIALS_UNSAFE]: A hardcoded secret key placeholder is provided in
SKILL.mdfor local development. The instructions correctly demonstrate fetching production secrets from environment variables using theenvoylibrary. - [EXTERNAL_DOWNLOADS]: The GitHub Actions template in
assets/github-actions/ci.ymluses the officialerlef/setup-beamaction to install the Gleam and Erlang toolchains. This is standard practice for the ecosystem. - [REMOTE_CODE_EXECUTION]: The CI/CD template contains a commented-out instruction for installing the Rust toolchain from its official source (
sh.rustup.rs). As this is a well-known official service and the code is provided as a template comment, it does not pose a risk.
Audit Metadata