implement-graphql
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to generate and review GraphQL implementation code based on user-provided requirements.
- Ingestion points: User-provided business requirements and schema definitions provided in natural language during agent interaction (referenced in SKILL.md and TESTING.md).
- Boundary markers: Absent. The instructions do not prescribe the use of specific delimiters to separate user inputs from the system instructions.
- Capability inventory: The agent has the capability to write and modify Ruby source code and test files, and execute shell commands to run test suites.
- Sanitization: The skill proactively implements sanitization patterns by enforcing the use of Pundit guards for sensitive fields, depth/complexity limits in the schema configuration, and structured error handling to prevent exception leakage.
- [SAFE]: The skill promotes several security best practices for GraphQL APIs, including explicitly disabling introspection in production via
disable_introspection_entry_pointsand setting resource limits withmax_depthandmax_complexityto prevent Denial of Service (DoS) attacks.
Audit Metadata