grammarly-sdk-patterns
Pass
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXPOSURE]: The skill provides code templates that correctly manage sensitive credentials by using environment variables (e.g.,
os.environ['GRAMMARLY_CLIENT_SECRET']) and thepython-dotenvlibrary, avoiding the risk of hardcoded secrets. - [EXTERNAL_DOWNLOADS]: The code references official Grammarly API endpoints (
api.grammarly.com) and documentation. These are well-known, trusted services for the context of this skill. - [INDIRECT_PROMPT_INJECTION]: Although the skill defines methods that ingest untrusted text for processing (
score,detectAI), it includes explicit instructional safeguards requiring that the agent 'Never record input text, suggestions, credentials, or user identifiers' and avoids logging rejected text to diagnose failures. - [COMMAND_EXECUTION]: The skill uses standard HTTP libraries (
fetchin TypeScript andrequestsin Python) for API communication, with no evidence of shell command execution or unauthorized system access.
Audit Metadata