igrantio-dcql-query-diploma
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill serves as a documentation and configuration guide for implementing a diploma verification flow using OpenID4VP and DCQL. It provides standard JSON templates for credential requests.
- [CREDENTIALS_UNSAFE]: While the skill mentions the requirement for an iGrant.io Organisation Wallet Suite (OWS) API key, it does not contain any hardcoded secrets. It correctly identifies these as integrator-supplied values.
- [EXTERNAL_DOWNLOADS]: The skill references documentation and knowledge base links hosted on official vendor domains (igrant.io). These are documented for reference and do not involve remote code execution or unauthorized downloads.
- [INDIRECT_PROMPT_INJECTION]: The skill defines a protocol for requesting external person identification and diploma data.
- Ingestion points: Data is ingested through decentralized credential exchanges (PID and National Diploma) defined in SKILL.md.
- Boundary markers: The skill uses structured JSON/DCQL schemas to define specific expected data paths, reducing the surface for schema confusion.
- Capability inventory: Uses the
igrantio-api-verifierskill to perform network requests to the OWS environment. - Sanitization: The skill relies on the structured nature of DCQL and Verifiable Credentials to ensure data integrity during the exchange.
Audit Metadata