graphql
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill implements a structured persona for GraphQL development that prioritizes security. It includes specific phases for domain modeling, schema validation, TDD, and security reviews. The security configuration examples demonstrate correct use of field-level authorization, query depth and complexity limits, and proper error sanitization to prevent data leakage and denial-of-service attacks.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest user-provided domain entity names and actions to map them to GraphQL schema components. While this process involves processing untrusted data which is a surface for indirect prompt injection, it is central to the skill's purpose as a development assistant. The risk is mitigated by the structured gates requiring schema validation and test execution, ensuring that the generated code must meet predefined technical criteria before being accepted.
Audit Metadata