find-law-firm
Pass
Audited by Gen Agent Trust Hub on Jun 16, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill interacts exclusively with 'https://api.servicegraph.co', which is the vendor's own API for the service described. This is normal functionality for an API-driven skill.
- [CREDENTIALS_UNSAFE]: The skill instructs the agent on how to retrieve the 'SERVICEGRAPH_TOKEN' from the shell environment or '.env.local' files. This follows standard security practices for local development and secret management; no hardcoded credentials were found in the provided files.
- [COMMAND_EXECUTION]: Provides examples of 'curl' and 'openssl' commands for calculating 'firm_id' handles and interacting with the API. These are educational examples for the agent and user, not automated malicious execution.
- [DATA_EXFILTRATION]: While the skill reads '.env' files, it specifically looks for its own service token ('SERVICEGRAPH_TOKEN') to facilitate authorized API requests. There is no evidence of harvesting unrelated secrets or exfiltrating sensitive local data to the API.
Audit Metadata