igrantio-trustlist-entries
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides structured documentation and templates for interacting with the NXD trust-list backend API. It implements secure authentication patterns using OAuth2 client credentials and provides clear instructions for users to provide their own secrets rather than hardcoding them.
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the injection of metadata (names, addresses, URIs) into a trust list, which is a public record consumed by third-party wallet solutions and verifiers. This represents a potential surface for indirect injection if downstream systems fail to sanitize these fields.
- Ingestion points: The
PUT /admin/participantsrequest body fields such asname,address, andinformation_uriinSKILL.md. - Boundary markers: None are specified for the descriptive metadata fields.
- Capability inventory: The skill performs API operations (
PUT,DELETE,POST) to modify external trust anchors. - Sanitization: The skill mentions regex validation for the
participant_idfield, but does not describe sanitization for descriptive strings.
Audit Metadata