testland/grpcurl-cli
Wraps grpcurl, the curl-equivalent CLI for gRPC. Covers descriptor sources (server reflection default, --import-path + --proto for proto files, --protoset for compiled descriptor sets), service discovery (`list`, `describe`), invoking unary RPCs (`-d '{...}'`, `-d @file.json`, `-d @` for stdin), streaming RPCs (newline-delimited JSON via stdin), TLS configuration (--cacert, --cert, --key, --insecure, --plaintext), header injection (-H 'Authorization: Bearer ...'), and exit codes. Use for ad-hoc gRPC debugging, smoke testing, scriptable PR-time gates, and CLI-based interaction with reflective gRPC services.
69
87%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
Low
Low-risk findings worth noting
W011: Third-party content exposure detected (indirect prompt injection risk).
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
The GitHub Actions deployment workflow monitors deployment status events, which can be triggered by external contributors or webhook payloads containing outsider-authored free text.
Where we found it
deployment event payload
content-type · 2 sites
The GitHub Actions workflow triggers on deployment_status events and reads github.event.deployment.payload.host from the event payload, which can be controlled by external contributors creating deployments, then uses it as the target host for grpcurl invocations.
SKILL.md
252
${{ github.event.deployment.payload.host }}:443
SKILL.md
261
${{ github.event.deployment.payload.host }}:443
- Audited
- Security analysis