graphql-architect
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFECREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides standard technical documentation for GraphQL architecture without any malicious instructions.
- [CREDENTIALS_UNSAFE]: Examples demonstrate best practices by using environment variables (process.env.JWT_SECRET) for secrets rather than hardcoded credentials.
- [EXTERNAL_DOWNLOADS]: References official Apollo Federation specifications and trusted ecosystem libraries for development.
- [COMMAND_EXECUTION]: Uses standard file system calls (fs.readFileSync) to load schema definitions in a typical subgraph setup.
- [DYNAMIC_EXECUTION]: Employs Apollo Federation's IntrospectAndCompose for dynamic schema management, which is a legitimate architectural pattern.
- [INDIRECT_PROMPT_INJECTION]: The skill documents APIs ingesting user input via mutations (Ingestion points). It recommends schema constraints and Zod validation (Boundary markers/Sanitization) and identifies database access and network requests as core functions (Capability inventory).
Audit Metadata