api-patterns
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill includes a script (scripts/api_validator.py) to scan local directories for API-related files and OpenAPI specifications. The script identifies best practice implementations like error handling and status codes.
- [INDIRECT_PROMPT_INJECTION]: The validation script acts as an ingestion point for external data by reading project files. While this creates a potential attack surface, the script's functionality is limited to read-only pattern matching for design evaluation.
- Ingestion points: scripts/api_validator.py reads files matching patterns like **/api.ts via pathlib.Path.read_text().
- Boundary markers: No specific delimiters or instructions to ignore embedded content are present.
- Capability inventory: The script performs file discovery and text reading; it has no network access or file writing capabilities.
- Sanitization: The script performs regex-based scanning of raw text without sanitization.
Audit Metadata