graphql
Fail
Audited by Gen Agent Trust Hub on Jul 11, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill facilitates the execution of remote code by cloning and running scripts from non-trusted GitHub accounts.\n
- Evidence: The skill instructs the user to
git clone https://github.com/nikitastupin/clairvoyanceand subsequently executepython3 -m clairvoyance.\n - Evidence: The skill instructs the user to
git clone https://github.com/dolevf/graphql-copand executepython3 graphql-cop.py.\n- [EXTERNAL_DOWNLOADS]: The skill performs unverified external downloads and installations.\n - Evidence: It requires running
pip install -r requirements.txton a freshly cloned repository, which can pull in arbitrary and potentially malicious dependencies.\n- [COMMAND_EXECUTION]: The skill makes extensive use of the shell to perform network probing and local file manipulation.\n - Evidence: Use of
curlfor endpoint discovery and schema extraction.\n - Evidence: Creation of local files like
introspection.jsonusingcatand shell redirection.\n- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to the lack of sanitization of external data.\n - Ingestion points: Untrusted data enters the context through
curlresponses and output from tools likegraphw00f.\n - Boundary markers: Absent; there are no instructions to the agent to treat target responses as untrusted or to ignore embedded instructions.\n
- Capability inventory: The skill possesses capabilities for network operations (
curl), file system writes, and execution of Python/Git commands.\n - Sanitization: Absent; the skill does not include steps to filter or escape content retrieved from the GraphQL endpoints.
Recommendations
- AI detected serious security threats
Audit Metadata