grammarly-debug-bundle
Pass
Audited by Gen Agent Trust Hub on Aug 21, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill communicates with Grammarly's official API (
api.grammarly.com) viacurlandfetch. These network operations are necessary for the skill's primary purpose of diagnosing API connectivity and performance issues. - [DATA_EXPOSURE]: The diagnostic script checks for the presence of environment variables
GRAMMARLY_API_KEYandGRAMMARLY_CLIENT_ID. It follows security best practices by masking the actual values in the generated summary logs, only recording whether the variables are set. - [COMMAND_EXECUTION]: The skill provides standard bash scripts for gathering diagnostic information and archiving it into a tarball. The commands used (
mkdir,curl,tar,rm) are routine for creating debug bundles and do not involve unauthorized privilege escalation or persistence mechanisms. - [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes data from Grammarly API responses (text analysis results and account info). While this creates a surface for data processing, the ingestion is limited to well-known service endpoints for specific troubleshooting tasks, representing a low risk profile.
Audit Metadata