api-security
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill implements strong defensive guardrails. It explicitly instructs the agent to refuse requests for custom cryptography ("Roll-Your-Own Crypto Veto") and to avoid printing detected secrets in output.
- [INDIRECT_PROMPT_INJECTION]: The skill's primary function involves auditing and scanning API controllers and routers, which represents an attack surface for indirect prompt injection.
- Ingestion points: Controller and router source files identified during scanning (SKILL.md).
- Boundary markers: None explicitly defined in the instructions to separate untrusted code from agent instructions.
- Capability inventory: Auditing, scanning, and suggesting code patches; specific tools are scoped to the agent platform's defaults.
- Sanitization: The skill mandates strict payload parsing and security guards for the implementation targets, but does not specify internal prompt sanitization for the agent itself.
Audit Metadata