apollo-router-plugin-creator

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill references the official Apollo Router GitHub repository and plugin directory (github.com/apollographql/router) for examples and source code. These references target the vendor's official infrastructure and are considered safe.
  • [COMMAND_EXECUTION]: The documentation provides example grep commands to assist users in searching for specific service hook implementations within a local checkout of the Apollo Router repository. These commands are educational and pose no risk.
  • [DYNAMIC_EXECUTION]: The skill provides structured Rust code templates and boilerplate for creating native plugins. These plugins are intended to be compiled and loaded by the Apollo Router. The provided patterns, such as the Plugin trait implementation and register_plugin! macro, are standard for the Apollo Router ecosystem.
  • [INDIRECT_PROMPT_INJECTION]: The skill guides the creation of middleware that processes untrusted GraphQL request data.
  • Ingestion points: Service hooks like router_service and supergraph_service ingest raw HTTP and GraphQL data (SKILL.md, references/service-hooks.md).
  • Boundary markers: The templates provide the structure for handling data but do not implement specific delimiters for downstream LLM processing, as they are generic development guides.
  • Capability inventory: The generated plugins have the capability to modify request headers, query plans, and response bodies.
  • Sanitization: The examples demonstrate data transformation (e.g., map_request, map_response) which provides the mechanism for users to implement validation and sanitization as needed for their specific use cases.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 02:50 PM
Security Audit — agent-trust-hub — apollo-router-plugin-creator