endpoint-creator
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the
dxscommand-line interface to perform administrative tasks on API applications. - Evidence: Execution of
dxs endpoint add,dxs endpoint update, anddxs endpoint removeas detailed inSKILL.mdandreferences/command-syntax.md. - [INDIRECT_PROMPT_INJECTION]: The skill relies on an external 'requirements brief' from the conversation context to determine the configuration of API endpoints.
- Ingestion points: The requirements brief is used in Phase 1 and Phase 2 to extract intent and endpoint metadata.
- Boundary markers: The skill does not define specific delimiters for the requirements brief data.
- Capability inventory: The agent has the capability to add, rename, and delete API endpoints via the
dxsCLI. - Sanitization: The skill implements strict alias validation using the regex
^[a-zA-Z0-9]+(?:[/-_~]*[a-zA-Z0-9]+)*$and maintains a list of reserved aliases (app,settings, etc.) to prevent collision or misuse.
Audit Metadata