web-data-fetching-graphql-urql
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of data from external GraphQL APIs, establishing a potential surface for indirect prompt injection.
- Ingestion points: Data is received through
useQuery,useMutation, anduseSubscriptionhooks as detailed inexamples/core.mdandexamples/subscriptions.md. - Boundary markers: The provided examples do not include explicit delimiters or instructions to prevent the agent from following directions potentially embedded in the API responses.
- Capability inventory: The skill demonstrates capabilities for network communication via
fetchand WebSockets, and manages authentication tokens via local storage inexamples/exchanges.md. - Sanitization: No explicit content validation or sanitization logic is presented for the data returned from the GraphQL endpoints.
- [SAFE]: The skill correctly implements security best practices, such as using environment variables for API endpoints and admin tokens, and providing clear red flags about query visibility in proxy and access logs.
Audit Metadata