api-recon-and-docs
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill includes shell commands using curl and grep to extract API paths from client-side JavaScript files.
- [INDIRECT_PROMPT_INJECTION]: The skill defines a workflow for ingesting and analyzing untrusted external data such as API documentation and source code, creating a potential surface for indirect prompt injection.
- Ingestion points: Fetches content from target URLs and documentation paths (SKILL.md).
- Boundary markers: No delimiters or specific instructions to ignore embedded prompts are provided.
- Capability inventory: Use of curl for network requests and grep for processing (SKILL.md).
- Sanitization: No explicit sanitization of the external content is performed.
Audit Metadata