the-graph
Pass
Audited by Gen Agent Trust Hub on Aug 4, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides technical documentation and examples for using official developer tools and services related to The Graph protocol. All external URLs point to official domains (thegraph.com, assemblyscript.org) and well-known services.
- [EXTERNAL_DOWNLOADS]: Skill instructions reference the standard installation of official packages including
@graphprotocol/graph-cliand@graphprotocol/graph-tsfrom the public npm registry. These are verified tools within the protocol's ecosystem. - [COMMAND_EXECUTION]: The skill provides instructions for common development CLI commands (e.g.,
graph init,graph codegen,graph build,graph deploy). These commands are intended for local subgraph development and deployment to the official Subgraph Studio. - [SAFE]: Although the skill documents processing untrusted data from blockchain events, the execution environment (Graph Node) uses a strictly restricted WebAssembly sandbox.
- Ingestion points: Smart contract event parameters (
event.params) ingested inmapping.tsandfactory.tsfiles. - Boundary markers: Mapping logic explicitly assigns values to schema-defined fields.
- Capability inventory: AssemblyScript mappings are limited to store operations (
Entity.load,entity.save). They lack the capability to perform network requests, access the host file system, or execute shell commands. - Sanitization: The transformation logic converts raw blockchain log data into structured entity types defined in the schema, effectively validating the data format.
Audit Metadata