api-routes
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill provides documentation for building API routes that process untrusted external data.
- Ingestion points: Data is ingested via
request.json()(in the AI proxy example) andurl.searchParams(in the weather proxy example). - Boundary markers: The code examples do not include explicit delimiters or instructions to ignore embedded commands within the interpolated variables.
- Capability inventory: The skill uses
fetchfor network operations to external services. - Sanitization: The skill's rules explicitly state to 'ALWAYS validate and sanitize user input,' though the simplified code examples do not demonstrate the specific implementation of these safeguards.
- [EXTERNAL_DOWNLOADS]: The skill provides instructions for installing the
eas-clitool and incorporating the@libsql/clientlibrary into the project for database connectivity.
Audit Metadata