igrantio-holder-notifications
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFECREDENTIALS_UNSAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill transmits authentication tokens (API keys or Bearer tokens) as a URL query parameter in its Server-Sent Events (SSE) relay. Although this is documented as a workaround for EventSource limitations and is intended for use between the backend relay and the upstream service, sending credentials in URLs is a security risk because they can be captured in server logs or proxy infrastructure.
- Evidence in
references/notificationsSse.ts: Theauthorizationtoken is appended to theURLSearchParamswhich is then used to construct the upstream fetch URL. - [INDIRECT_PROMPT_INJECTION]: The skill processes notification data from external iGrant.io APIs to determine the agent's next actions, creating a surface for indirect prompt injection.
- Ingestion points: Notification data enters the system through the
NotificationsClient(REST) and the SSE stream relay inreferences/notificationsClient.tsandreferences/notificationsSse.ts. - Boundary markers: None. The skill does not use specific delimiters or instructions to ignore potential commands embedded in notification content.
- Capability inventory: The skill uses
fetchfor network requests and includes logic (deriveNotificationAction) that maps notification content to specific follow-up actions like opening authorization requests or submitting credentials. - Sanitization: None. The notification content is parsed and processed without validation or filtering of potential instructional content.
Audit Metadata