igrantio-backend-proxy
Pass
Audited by Gen Agent Trust Hub on Jul 20, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: No suspicious command execution or shell spawning was detected. The code uses standard Express.js routing to handle HTTP requests.
- [DATA_EXFILTRATION]: The skill is designed to prevent data exfiltration (specifically API key exposure to the browser). It retrieves API keys from environment variables and injects them into upstream requests server-side. Sensitive headers are filtered using a hop-by-hop header removal strategy.
- [REMOTE_CODE_EXECUTION]: No patterns for remote code execution (e.g.,
eval,exec, or downloading scripts to pipe into a shell) were identified. All network operations are limited to defined upstream API environments. - [PROMPT_INJECTION]: The skill contains technical instructions for a backend proxy and does not include prompts that attempt to override AI safety guidelines or extract system information.
- [EXTERNAL_DOWNLOADS]: The code references official iGrant.io domains (
demo-api.igrant.io,staging-api.igrant.io) for its upstream API operations, which is consistent with the skill's stated purpose.
Audit Metadata