governance-intel
Pass
Audited by Gen Agent Trust Hub on Aug 3, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches governance data (proposals, votes, space metadata) from Snapshot's official public GraphQL API (hub.snapshot.org). This is a well-known service for DAO governance and the integration is performed using standard HTTP requests with no authentication required.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from Snapshot proposals (titles, descriptions, and choices).
- Ingestion points: Data is fetched via GraphQL in
proposal_scanner.py,voting_analyzer.py, anddao_health.py. - Boundary markers: No specific boundary markers or instructions to ignore embedded commands are present in the skill's guidelines.
- Capability inventory: The skill is limited to data processing and JSON output. It lacks dangerous capabilities such as file system writes, shell command execution, or secondary network requests based on fetched content.
- Sanitization: The scripts perform type validation and basic formatting but do not explicitly sanitize or escape the text content before it is passed to the agent's context.
Audit Metadata