igrantio-consent-records
Pass
Audited by Gen Agent Trust Hub on Aug 5, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill follows standard security practices for Node.js backend development, specifically by using environment variables (via
dotenv) to manage sensitive Organisation API keys and preventing their exposure to the client-side. - [SAFE]: Network communication is limited to the official iGrant.io domains (demo and staging APIs) for consent management, which is consistent with the skill's stated purpose.
- [SAFE]: The skill correctly implements server-side identity resolution. While the example server (
references/src/server.ts) uses a header-based resolver for demonstration purposes, it includes explicit documentation and code comments warning developers to replace this with a secure session-based mapping in production environments. - [SAFE]: The skill possesses an indirect prompt injection attack surface as it ingests and processes external API data, though the risk is minimized by the use of structured data and backend logic.
- Ingestion points: Data returned from iGrant.io API endpoints in
references/src/consentClient.ts. - Boundary markers: None explicitly defined; data is processed as structured JSON.
- Capability inventory: Network access (fetch) and file system access (read
.envconfiguration). - Sanitization: Standard JSON parsing of API responses.
Audit Metadata