dual-auth-rbac
Pass
Audited by Gen Agent Trust Hub on Mar 4, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill functions as a high-quality educational template for implementing secure authentication. It includes comprehensive security checklists for passwords, JWTs, sessions, and multi-tenant isolation.- [PROMPT_INJECTION]: The requirement to use a 'Superpowers plugin' and favor certain design decisions are behavioral instructions intended to guide the agent's output style and tool usage. These do not attempt to bypass safety filters or extract internal system prompts.- [CREDENTIALS_UNSAFE]: The skill uses appropriate placeholders and shell command examples (e.g., openssl rand) for sensitive values like JWT_SECRET and PASSWORD_PEPPER, ensuring no real credentials or tokens are exposed.- [COMMAND_EXECUTION]: Example commands provided are for environment setup and local development (e.g., openssl, database migrations) and do not involve the execution of arbitrary or dangerous code.- [EXTERNAL_DOWNLOADS]: No suspicious remote scripts or external code downloads are requested. The libraries mentioned (e.g., jsonwebtoken, argon2) are standard industry packages for the described implementation.
Audit Metadata