grammarly-debug-bundle

Pass

Audited by Gen Agent Trust Hub on Aug 21, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill communicates with Grammarly's official API (api.grammarly.com) via curl and fetch. These network operations are necessary for the skill's primary purpose of diagnosing API connectivity and performance issues.
  • [DATA_EXPOSURE]: The diagnostic script checks for the presence of environment variables GRAMMARLY_API_KEY and GRAMMARLY_CLIENT_ID. It follows security best practices by masking the actual values in the generated summary logs, only recording whether the variables are set.
  • [COMMAND_EXECUTION]: The skill provides standard bash scripts for gathering diagnostic information and archiving it into a tarball. The commands used (mkdir, curl, tar, rm) are routine for creating debug bundles and do not involve unauthorized privilege escalation or persistence mechanisms.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes data from Grammarly API responses (text analysis results and account info). While this creates a surface for data processing, the ingestion is limited to well-known service endpoints for specific troubleshooting tasks, representing a low risk profile.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 21, 2026, 06:30 PM
Security Audit — agent-trust-hub — grammarly-debug-bundle