igrantio-credential-schema-sca-payment-user
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references schema definitions hosted on GitHub (github.com/decentralised-dataexchange/verifiable-data-registry). These are used to align the credential definitions with industry-standard registries for verifiable data.
- [CREDENTIALS_UNSAFE]: The documentation mentions the requirement for an iGrant.io Organisation Wallet Suite (OWS) API key. It correctly follows security best practices by instructing users to store these credentials in environment variables or secret managers, ensuring they are not exposed in client-side code.
- [INDIRECT_PROMPT_INJECTION]: The skill provides a template for verifiable credentials. Ingestion points include API requests for credential issuance and configuration. The capability inventory is limited to standard POST requests to vendor-owned API endpoints. Sanitization and validation are managed by the iGrant.io platform's schema enforcement. The schema for this specific credential type (TS12) has an empty claims array, posing no significant injection risk.
Audit Metadata