igrantio-dcql-query-pid-v2
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFENO_CODE
Full Analysis
- [NO_CODE]: The skill does not contain any executable scripts, shell commands, or binary files. It consists entirely of documentation and JSON configuration templates for data structures.
- [SAFE]: The instructions correctly advise users to store sensitive API credentials in environment variables or secret managers, following security best practices to prevent credential exposure.
- [INDIRECT_PROMPT_INJECTION]: The skill defines the attack surface for ingesting external identity data (Person Identification Data) from user wallets.
- Ingestion points: Identity data is received from digital wallets via the iGrant.io API as defined in SKILL.md.
- Boundary markers: The skill uses structured JSON paths and specific namespaces (e.g.,
eu.europa.ec.eudi.pid.1) to delimit data. - Capability inventory: The skill relies on API interactions with the iGrant.io Organisation Wallet Suite (OWS) for verification flows.
- Sanitization: Validation of the data format and schema is handled by the platform and the required
igrantio-api-verifierskill.
Audit Metadata