authoring-api-reference

Pass

Audited by Gen Agent Trust Hub on Jun 14, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill follows secure design principles for documentation agents. It establishes a clear chain of custody for data, mandating that all output must be grounded in an 'upstream api-spec' contract and prohibiting the model from inventing or fabricating details.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external technical documents provided by the user, which constitutes a potential injection surface.
  • Ingestion points: Processes api-spec, feature-spec, and architecture-doc as primary inputs (documented in the 'Inputs' section of SKILL.md).
  • Boundary markers: The skill implements strong logical boundaries by instructing the agent to 'Derive every endpoint from the api-spec' and verifying that 'every documented endpoint must exist in the contract.' It explicitly surfaces gaps as assumptions rather than following ambiguous instructions.
  • Capability inventory: The skill is limited to generating textual documentation in markdown format, including code snippets and request/response examples.
  • Sanitization: Not explicitly mentioned, though the skill's methodology requires strict adherence to the structural schema provided by a separate template tool.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 14, 2026, 07:32 PM
Security Audit — agent-trust-hub — authoring-api-reference