generate-api-collection
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests Rails routes and controller source code to automatically generate API collection files. This creates a potential vector where malicious instructions embedded in source code could influence the agent's behavior or output.\n
- Ingestion points: Rails route definitions and controller files (SKILL.md).\n
- Boundary markers: No explicit delimiters or instructions to ignore embedded commands in source data are provided.\n
- Capability inventory: The skill performs file system writes and executes shell commands (
jq,python) to validate output.\n - Sanitization: There are no instructions for escaping or sanitizing content extracted from the source code before it is written to the collection JSON.\n- [COMMAND_EXECUTION]: The skill requires the agent to execute shell commands (
jq .andpython -m json.tool) to validate the syntax of generated JSON files. While these are standard development tools, they represent an automated use of the command line for local file validation.
Audit Metadata