api-documenter
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external data such as API specifications (OpenAPI, AsyncAPI, GraphQL) and source code comments, which creates a theoretical attack surface for indirect prompt injection.
- Ingestion points: External API definition files (YAML/JSON) and project source code annotations.
- Boundary markers: The instructions do not specify any delimiters or warnings to ignore embedded instructions in the processed specifications.
- Capability inventory: The skill mentions capabilities for SDK generation and CI/CD integration, but no specific scripts or tools are included in the skill definition to perform these actions.
- Sanitization: No explicit validation or sanitization requirements for external inputs are provided in the behavioral instructions.
Audit Metadata