igrantio-holder-frontend
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill architecture centralizes sensitive operations on the backend. The frontend components communicate with an iGrant.io Organisation Wallet Suite (OWS) proxy, ensuring that high-privilege API keys are never included in the browser bundle.
- [SAFE]: Data privacy is prioritized through the implementation of a "blur-by-default" mechanism for personal data in the
CredentialDetailandClaimsTablecomponents. This ensures that sensitive claims are only visible after explicit user interaction (toggling the eye icon). - [INDIRECT_PROMPT_INJECTION]: The skill includes logic to process external
openid-credential-offer://andopenid4vp://URIs via deep links and user input. This ingestion surface is fundamental to the Wallet protocol's functionality. The skill handles these inputs safely by passing them to a controlled backend proxy and validating the responses against a strictly typed client (holderClient.ts). - [SAFE]: The skill uses well-known, versioned dependencies (
qrcode,react) and does not perform any suspicious command execution or privilege escalation. Network operations are limited to standard OIDC flow redirections and registry lookups for credential metadata resolution.
Audit Metadata