igrantio-dcql-query-sca-payment-card
Pass
Audited by Gen Agent Trust Hub on Aug 9, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: The instructions do not contain any patterns aimed at overriding agent behavior, bypassing safety filters, or extracting system prompts.
- [DATA_EXFILTRATION]: No hardcoded secrets or sensitive file access patterns were identified. Network operations mentioned (POST/GET) target the vendor domain (igrant.io) and are used for standard credential verification purposes. The skill design explicitly minimizes data exposure by only requesting truncated card data (pan_last_four).
- [REMOTE_CODE_EXECUTION]: No remote code patterns, shell command execution, or dynamic script generation were detected in the skill content.
- [INDIRECT_PROMPT_INJECTION]: The skill defines a surface for ingesting verifiable credential data (Ingestion points: wallet response tokens). The use of structured path mapping and JSON schema definitions (Boundary markers) effectively scopes the data being processed. The skill lacks dangerous executable capabilities like subprocess calls (Capability inventory), and sanitization is managed through the verifier API validation layers.
- [OBFUSCATION]: The skill was analyzed for Base64, hex encoding, and hidden character patterns (such as zero-width spaces or Unicode tags); no hidden or obfuscated content was found.
Audit Metadata