graphql-schema
Pass
Audited by Gen Agent Trust Hub on Jul 2, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute project-level build and synchronization commands, specifically
npm run gql:typegenandnpm run sync-types. These are standard development tasks for GraphQL type generation and schema synchronization. - [INDIRECT_PROMPT_INJECTION]: The skill involves reading and writing project source files (GraphQL schemas and TypeScript components) to generate and modify code. This represents a standard attack surface for indirect prompt injection if the project files being processed contain malicious instructions.
- Ingestion points: Processes
.gqland.tsxfiles within the user's project workspace. - Boundary markers: No specific delimiters or "ignore instructions" warnings are provided for the agent when processing these files.
- Capability inventory: Includes shell command execution through the
npmCLI. - Sanitization: No explicit sanitization or validation of the input file content is mentioned, relying on standard development tool behavior.
Audit Metadata