igrantio-api-key-management
Warn
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: MEDIUMCREDENTIALS_UNSAFE
Full Analysis
- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill documentation indicates that the API endpoint
GET /v2/config/digital-wallet/openid/key-managementreturns sensitive vault credentials in clear text. This includes thevaultPasswordfor Hashicorp Vault andclientSecretfor QTSP configurations, which could lead to accidental exposure if the response is logged or improperly handled.\n- [INDIRECT_PROMPT_INJECTION]: The skill documents an interface that ingests sensitive user configurations and performs network operations, creating a surface for potential exploitation if the data sources used to populate these configurations are not authenticated or verified.\n - Ingestion points: Vault configuration request bodies (
hashicorpVault,qtsp) and QTSP credentials provided in theSKILL.mdinstructions.\n - Boundary markers: None identified. The documentation does not provide instructions for delimiting or sanitizing user-supplied data to prevent command or instruction injection.\n
- Capability inventory: Network POST, PUT, and GET requests to
demo-api.igrant.iofor managing encryption keys and vaults.\n - Sanitization: No evidence of input validation or credential sanitization before transmission to the API service.
Audit Metadata