igrantio-holder-frontend
Pass
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [SAFE]: The skill provides a standard, framework-agnostic implementation for a digital wallet portal, adhering to EUDI and OpenID4VC specifications. It correctly delegates sensitive operations (like API key management) to a backend proxy.
- [DATA_EXFILTRATION]: The skill handles highly sensitive personal data, including PII from identity credentials (e.g., PID, mDL). It includes built-in privacy protections by automatically blurring this data in the UI until the user explicitly chooses to view it, as seen in
CredentialDetail.tsxandClaimsTable.tsx. - [EXTERNAL_DOWNLOADS]: The skill performs network requests to resolve credential metadata, logos, and banners from external URLs provided in credential configurations (
credentialDisplay.ts). This behavior is consistent with the discovery mechanisms defined in decentralized identity protocols. - [COMMAND_EXECUTION]: The UI incorporates features for copying sensitive data (credential claims, offer endpoints) to the system clipboard via
navigator.clipboard.writeText. While this involves sensitive data, it is a standard convenience feature for the intended user flow. - [INDIRECT_PROMPT_INJECTION]: The skill defines ingestion points for untrusted external data, specifically credential offers and verification requests supplied via text area or deep links (
useHolder.ts). These inputs are processed according to protocol-defined state machines, representing the core functional surface of the wallet portal.
Audit Metadata