dpop-adoption
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [External Resource Integration]: The skill mentions an external Model Context Protocol (MCP) server for documentation retrieval. This tool is provided by the platform's service provider and is intended to fetch official developer guidelines.
- [Security Protocol Implementation]: The instructions describe the generation of DPoP proofs, which involves signing JWTs with non-extractable keys. This follows industry best practices for sender-constraining OAuth tokens to prevent replay attacks.
- [Identity Data Processing]: The logic for creating DPoP proofs ingests external parameters such as authorization codes and nonces. Standard sanitization routines (such as URL cleaning) are recommended within the skill to ensure tokens are bound to the correct intended audience.
- [Environment Compatibility]: The skill provides guidance on using native cryptographic libraries (WebCrypto) across different runtimes to ensure secure and consistent key management.
Audit Metadata