igrantio-dcapi-android
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill consists of high-level documentation and workflow instructions. It does not contain executable scripts, shell commands, or patterns that attempt to override agent safety protocols.
- [EXTERNAL_DOWNLOADS]: The skill references official documentation and API endpoints at
docs.igrant.io,demo-api.igrant.io, andstaging-api.igrant.io. These are legitimate vendor-controlled resources used for configuration and reference. - [CREDENTIALS_UNSAFE]: The skill explicitly warns against hardcoding API keys in the browser and recommends using environment variables or secret managers for server-side storage, demonstrating secure credential management practices.
- [INDIRECT_PROMPT_INJECTION]:
- Ingestion points: The skill describes processing
vpTokenResponsedata received from the browser's Digital Credentials API (SKILL.md). - Boundary markers: The workflow follows the structured OpenID4VP protocol, which limits the potential for instruction injection via free-text fields.
- Capability inventory: The described capabilities are limited to network communication with vendor-controlled API endpoints for verification purposes.
- Sanitization: The skill directs users to the
dcApi.tshelper reference inigrantio-verifier-frontend, which is designed to handle and validate the specific response formats.
Audit Metadata