grammarly-debug-bundle

Pass

Audited by Gen Agent Trust Hub on Sep 3, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill includes a Bash script that uses curl to interact with the Grammarly API (api.grammarly.com). These operations are consistent with the skill's stated purpose of providing diagnostic bundles for API troubleshooting. The script verifies the existence of GRAMMARLY_API_KEY and GRAMMARLY_CLIENT_ID in the environment without logging their values.\n- [EXTERNAL_DOWNLOADS]: The skill uses curl to make POST and GET requests to api.grammarly.com. These are legitimate API calls to a well-known service for the purpose of checking connectivity and account status. No remote scripts or binary payloads are downloaded or executed.\n- [DATA_EXPOSURE_EXFILTRATION]: While the skill collects diagnostic information (HTTP codes, JSON responses, and headers) into a local archive, it does not perform automated exfiltration to third-party domains. The instructions explicitly mandate a redaction process and the use of approved restricted destinations before any evidence leaves the local environment.\n- [DYNAMIC_EXECUTION]: The skill includes a TypeScript snippet for an automated health check. This code uses the standard fetch API to validate the Grammarly service status. It is a simple diagnostic script using known templates and does not involve unsafe deserialization or runtime code generation from untrusted sources.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 3, 2026, 10:33 AM