grammarly-multi-env-setup
Pass
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill does not contain any malicious patterns. It demonstrates best practices for credential management by using environment variables and external secret managers (Vault) rather than hardcoding sensitive information.
- [DATA_EXPOSURE]: The skill references environment variables such as
GRAMMARLY_PROD_CLIENT_SECRET. It explicitly instructs the agent to exclude credentials and source text from the final promotion receipt, reducing the risk of accidental data leakage. - [EXTERNAL_DOWNLOADS]: The skill interacts with official Grammarly API endpoints (
api.grammarly.com). These are well-known, legitimate services for the stated purpose of the skill. - [INDIRECT_PROMPT_INJECTION]: The promotion workflow involves reading JSON data (
test-content.json). While this represents a data ingestion point, the risk is considered low as the data is used for structured API requests and validation rather than influencing agent logic.
Audit Metadata