igrantio-credential-schema-diploma
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill defines standard integration patterns with the vendor's official infrastructure. It references official documentation and API endpoints belonging to iGrant.io (the vendor) and follows security best practices by instructing users to store API keys in environment variables or secret managers rather than hardcoding them.
- [INDIRECT_PROMPT_INJECTION]: The skill defines a schema for ingesting and processing external learner data which represents a theoretical attack surface for indirect prompt injection if the processing agent lacks proper sanitization.
- Ingestion points: Data enters the system via the
claimsarray defined inSKILL.md(e.g.,learnerName,qualificationName,result) and through user responses to configuration questions. - Boundary markers: The instructions do not specify explicit delimiters or boundary markers for the external claim data values.
- Capability inventory: The skill facilitates network operations via the iGrant.io API to create credential definitions and issue credentials.
- Sanitization: The skill does not explicitly describe sanitization or validation logic for the content of the claims, relying on the platform's implementation.
Audit Metadata