data-fetching

Pass

Audited by Gen Agent Trust Hub on Feb 16, 2026

Risk Level: LOW
Full Analysis
  • [Prompt Injection] (SAFE): The skill contains only instructional and technical content related to Next.js. No attempts to override system prompts or bypass safety guidelines were found.\n- [Data Exposure & Exfiltration] (SAFE): No hardcoded credentials or sensitive file path access (e.g., SSH keys, AWS configs) are present. All scripts operate on local project files for validation purposes.\n- [Obfuscation] (SAFE): No encoded strings, zero-width characters, or homoglyphs were detected in any of the analyzed files.\n- [Remote Code Execution] (SAFE): There are no patterns involving curl | bash or downloading/executing remote scripts. Dependencies like pyyaml are used for safe local processing.\n- [Indirect Prompt Injection] (SAFE): While the skill assists with data fetching, it does not ingest or process untrusted external data that is then interpolated into agent prompts in an unsafe manner.\n- [Dynamic Execution] (SAFE): The validation script uses yaml.safe_load() for configuration parsing, preventing unsafe deserialization attacks.
Audit Metadata
Risk Level
LOW
Analyzed
Feb 16, 2026, 04:00 AM