api-spec
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides structured guidance for API contract design and validation, emphasizing the use of authoritative sources and structural linters.
- [SAFE]: Security instructions explicitly forbid implementation changes, runtime execution, and modification of Git state, effectively enforcing a least-privilege execution environment.
- [SAFE]: The OpenAPI authoring guidelines include specific security warnings, such as ensuring identifiers are not trusted from the client and requiring standard authentication schemes.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests external data (API specifications and DTOs) in SKILL.md and references/contract-design.md, which creates an attack surface for indirect prompt injection. However, the risk is minimized by the skill's restricted output scope (YAML/JSON artifacts only as defined in SKILL.md) and the requirement for structural validation and verification of backend conformance in references/openapi-authoring.md.
Audit Metadata