grammarly-debug-bundle
Pass
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill includes a Bash script that uses
curlto interact with the Grammarly API (api.grammarly.com). These operations are consistent with the skill's stated purpose of providing diagnostic bundles for API troubleshooting. The script verifies the existence ofGRAMMARLY_API_KEYandGRAMMARLY_CLIENT_IDin the environment without logging their values.\n- [EXTERNAL_DOWNLOADS]: The skill usescurlto make POST and GET requests toapi.grammarly.com. These are legitimate API calls to a well-known service for the purpose of checking connectivity and account status. No remote scripts or binary payloads are downloaded or executed.\n- [DATA_EXPOSURE_EXFILTRATION]: While the skill collects diagnostic information (HTTP codes, JSON responses, and headers) into a local archive, it does not perform automated exfiltration to third-party domains. The instructions explicitly mandate a redaction process and the use of approved restricted destinations before any evidence leaves the local environment.\n- [DYNAMIC_EXECUTION]: The skill includes a TypeScript snippet for an automated health check. This code uses the standardfetchAPI to validate the Grammarly service status. It is a simple diagnostic script using known templates and does not involve unsafe deserialization or runtime code generation from untrusted sources.
Audit Metadata