frappe-core-files
Pass
Audited by Gen Agent Trust Hub on Mar 31, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill serves as an educational resource for Frappe file management, documenting standard framework utilities such as
save_fileandsave_url. - [SAFE]: Includes a specific reference file (
references/anti-patterns.md) that identifies and provides remediations for common security vulnerabilities: - Path Traversal (AP-2): Warns against manual path construction and recommends
frappe.utils.file_manager.get_file_pathfor safe resolution. - Permission Leaks (AP-1): Enforces the use of
is_private=1for sensitive data to prevent unauthenticated access. - Incomplete Deletion (AP-5): Recommends
frappe.delete_docover direct database deletion to ensure filesystem cleanup. - [SAFE]: Code examples use standard industry placeholders for sensitive information, such as
AKIA...for AWS access keys andexample.comfor domains. - [SAFE]: Provides proactive security measures in
references/examples.md, such as implementing file extension whitelists and enforcing file size limits through server-side hooks.
Audit Metadata