igrantio-dcql-query-diploma

Pass

Audited by Gen Agent Trust Hub on Sep 17, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill serves as a documentation and configuration guide for implementing a diploma verification flow using OpenID4VP and DCQL. It provides standard JSON templates for credential requests.
  • [CREDENTIALS_UNSAFE]: While the skill mentions the requirement for an iGrant.io Organisation Wallet Suite (OWS) API key, it does not contain any hardcoded secrets. It correctly identifies these as integrator-supplied values.
  • [EXTERNAL_DOWNLOADS]: The skill references documentation and knowledge base links hosted on official vendor domains (igrant.io). These are documented for reference and do not involve remote code execution or unauthorized downloads.
  • [INDIRECT_PROMPT_INJECTION]: The skill defines a protocol for requesting external person identification and diploma data.
  • Ingestion points: Data is ingested through decentralized credential exchanges (PID and National Diploma) defined in SKILL.md.
  • Boundary markers: The skill uses structured JSON/DCQL schemas to define specific expected data paths, reducing the surface for schema confusion.
  • Capability inventory: Uses the igrantio-api-verifier skill to perform network requests to the OWS environment.
  • Sanitization: The skill relies on the structured nature of DCQL and Verifiable Credentials to ensure data integrity during the exchange.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 17, 2026, 11:41 PM