scaffolding-api-routes
Pass
Audited by Gen Agent Trust Hub on Jul 25, 2026
Risk Level: SAFEPROMPT_INJECTIONNO_CODE
Full Analysis
- [SAFE]: No malicious patterns, such as command injection, data exfiltration, or persistence mechanisms, were detected within the skill instructions.
- [NO_CODE]: The skill consists solely of natural language instructions and does not bundle any executable scripts, binaries, or automated installation commands.
- [PROMPT_INJECTION]: The skill defines a workflow that ingests external project documentation, creating a potential surface for indirect prompt injection.
- Ingestion points: The agent reads legacy audit data from
docs/legacy-audit/API_Contracts.md. - Boundary markers: The skill lacks explicit delimiters or instructions to treat the documentation content as untrusted data.
- Capability inventory: The agent possesses the capability to write new source code files to the
src/app/api/directory. - Sanitization: There are no instructions for validating or sanitizing the content of the documentation before it is translated into code.
Audit Metadata