frappe-core-files

Pass

Audited by Gen Agent Trust Hub on Mar 31, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill serves as an educational resource for Frappe file management, documenting standard framework utilities such as save_file and save_url.
  • [SAFE]: Includes a specific reference file (references/anti-patterns.md) that identifies and provides remediations for common security vulnerabilities:
  • Path Traversal (AP-2): Warns against manual path construction and recommends frappe.utils.file_manager.get_file_path for safe resolution.
  • Permission Leaks (AP-1): Enforces the use of is_private=1 for sensitive data to prevent unauthenticated access.
  • Incomplete Deletion (AP-5): Recommends frappe.delete_doc over direct database deletion to ensure filesystem cleanup.
  • [SAFE]: Code examples use standard industry placeholders for sensitive information, such as AKIA... for AWS access keys and example.com for domains.
  • [SAFE]: Provides proactive security measures in references/examples.md, such as implementing file extension whitelists and enforcing file size limits through server-side hooks.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 31, 2026, 10:40 AM