data-fetching
Pass
Audited by Gen Agent Trust Hub on Feb 16, 2026
Risk Level: LOW
Full Analysis
- [Prompt Injection] (SAFE): The skill contains only instructional and technical content related to Next.js. No attempts to override system prompts or bypass safety guidelines were found.\n- [Data Exposure & Exfiltration] (SAFE): No hardcoded credentials or sensitive file path access (e.g., SSH keys, AWS configs) are present. All scripts operate on local project files for validation purposes.\n- [Obfuscation] (SAFE): No encoded strings, zero-width characters, or homoglyphs were detected in any of the analyzed files.\n- [Remote Code Execution] (SAFE): There are no patterns involving
curl | bashor downloading/executing remote scripts. Dependencies likepyyamlare used for safe local processing.\n- [Indirect Prompt Injection] (SAFE): While the skill assists with data fetching, it does not ingest or process untrusted external data that is then interpolated into agent prompts in an unsafe manner.\n- [Dynamic Execution] (SAFE): The validation script usesyaml.safe_load()for configuration parsing, preventing unsafe deserialization attacks.
Audit Metadata