igrantio-verifier-backend
Pass
Audited by Gen Agent Trust Hub on Nov 3, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements a robust security model for its reference backend.\n- [DATA_EXFILTRATION]: The proxy service in references/src/proxy.ts is designed to prevent API key exposure by injecting secrets server-side. It includes a hasDotSegment check and a strict permittedPrefixes allow-list to prevent path traversal and unauthorized access to OWS management endpoints.\n- [INDIRECT_PROMPT_INJECTION]: While the service ingests external data via webhooks, it implements mandatory HMAC-SHA256 signature verification using timingSafeEqual in references/src/webhooks.ts to ensure data authenticity and prevent timing attacks.\n- [COMMAND_EXECUTION]: No unauthorized command execution or unsafe shell patterns were detected. All scripts use standard Node.js/TypeScript execution patterns.\n- [CREDENTIALS_UNSAFE]: The skill correctly advises storing sensitive OWS API keys in environment variables or secret managers, ensuring they never reach the client-side frontend.
Audit Metadata