competition-graphql-rpc-drift
Pass
Audited by Gen Agent Trust Hub on Jun 20, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXPOSURE]: The skill instructs the agent to capture network request details, including headers, cookies, and authentication context. This is consistent with its stated purpose as a security analysis tool for identifying hidden or stale operations. There are no instructions or mechanisms to exfiltrate this data to external services.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted external data, such as GraphQL schemas, introspection results, and captured network traffic. This represents an attack surface for indirect prompt injection.
- Ingestion points: Network request pairs, schema definitions, RPC manifests, and OpenAPI documents mentioned in
SKILL.mdandreferences/graphql-rpc-drift.md. - Boundary markers: None identified in the provided instructions.
- Capability inventory: No file-system writes, network operations, or subprocess executions are defined within this skill's scripts.
- Sanitization: No specific sanitization or validation steps are defined for the ingested data.
Audit Metadata