topolograph-igp-analysis
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes link-state topology data, including node metadata and event logs, from an external API. This data represents a surface for indirect prompt injection if the ingested content contains instructions designed to influence the agent.
- Ingestion points: External data is processed via tools like
get_graph_by_time,get_nodes, andget_events_timelinein SKILL.md. - Boundary markers: The instructions do not define specific delimiters or instructions for the agent to treat external network data as untrusted content.
- Capability inventory: The skill is restricted to analytical functions; it lacks capabilities for arbitrary shell execution, file system modification, or persistence mechanisms.
- Sanitization: No specific filtering or sanitization of the API-returned topology data is mentioned.
- [EXTERNAL_DOWNLOADS]: The skill references and communicates with
https://topolograph.com/mcp, which is the official endpoint for the topology analysis service described in the skill. - [SAFE]: The skill documentation correctly specifies that the
TOPOLOGRAPH_API_TOKENshould be provided via environment variables, adhering to standard security practices for credential handling.
Audit Metadata