the-graph

Pass

Audited by Gen Agent Trust Hub on Aug 4, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill provides technical documentation and examples for using official developer tools and services related to The Graph protocol. All external URLs point to official domains (thegraph.com, assemblyscript.org) and well-known services.
  • [EXTERNAL_DOWNLOADS]: Skill instructions reference the standard installation of official packages including @graphprotocol/graph-cli and @graphprotocol/graph-ts from the public npm registry. These are verified tools within the protocol's ecosystem.
  • [COMMAND_EXECUTION]: The skill provides instructions for common development CLI commands (e.g., graph init, graph codegen, graph build, graph deploy). These commands are intended for local subgraph development and deployment to the official Subgraph Studio.
  • [SAFE]: Although the skill documents processing untrusted data from blockchain events, the execution environment (Graph Node) uses a strictly restricted WebAssembly sandbox.
  • Ingestion points: Smart contract event parameters (event.params) ingested in mapping.ts and factory.ts files.
  • Boundary markers: Mapping logic explicitly assigns values to schema-defined fields.
  • Capability inventory: AssemblyScript mappings are limited to store operations (Entity.load, entity.save). They lack the capability to perform network requests, access the host file system, or execute shell commands.
  • Sanitization: The transformation logic converts raw blockchain log data into structured entity types defined in the schema, effectively validating the data format.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 4, 2026, 12:32 AM
Security Audit — agent-trust-hub — the-graph