api-reference-audit
Pass
Audited by Gen Agent Trust Hub on Aug 5, 2026
Risk Level: SAFE
Full Analysis
- External Data Integration: The skill fetches version data from established package registries, including PyPI, npm, and Maven Central, as well as the GitHub API. Accessing these well-known services is a standard requirement for auditing software release cycles.
- Local Automation Scripts: To manage documentation updates, the skill references internal shell scripts located within the repository's
tools/directory (e.g.,generate.sh). This approach leverages the project's own infrastructure for automation tasks. - Administrative Tooling: The skill utilizes the GitHub CLI (
gh) to verify pull request history and release tags. This is a common practice for development-oriented agents to maintain context within a version control environment. - Data Processing Surface: As the skill ingests data from external APIs (registries and GitHub) to compare versions, it possesses an attack surface for indirect prompt injection. However, the risk is minimal as the instructions guide the agent to parse specific structured fields like
info.version, and any subsequent actions require explicit user confirmation. - Operational Oversight: The skill is configured to report drift and recommend processes without editing files or opening pull requests by default. This design ensures that the user remains the final authority for all state-changing operations.
Audit Metadata