api-sync
Pass
Audited by Gen Agent Trust Hub on Aug 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the GitHub CLI (
gh api) to query thebasecamp/bc3repository for revisions and to fetch documentation and source code contents. - [COMMAND_EXECUTION]: A sequence of
makecommands (e.g.,smithy-build,go generate,ts-generate) is executed to regenerate SDK components and perform local build validation. - [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface by ingesting content from an external repository to influence synchronization logic.
- Ingestion points: Upstream documentation and controller code are fetched via the GitHub API in Phase 3.
- Boundary markers: Not present; the skill lacks specific delimiters to isolate external content from the agent's instructions.
- Capability inventory: The skill has the ability to execute system commands through
makeand write updates to thespec/directory. - Sanitization: No validation or sanitization of the fetched content is specified before the agent evaluates it for specification gaps.
Audit Metadata