api-designer
Fail
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: CRITICALINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes business requirements to generate API specifications, creating a potential injection surface. * Ingestion points: Workflow step 1 involves analyzing user-provided domain requirements. * Boundary markers: No explicit delimiters or instructions are provided to isolate user requirements. * Capability inventory: Shell commands are executed on the resulting contract using npx. * Sanitization: No validation of requirements is performed before modeling.
- [COMMAND_EXECUTION]: The skill instructs the agent to run command-line tools for linting and mocking API contracts. * Evidence: Commands include npx @redocly/cli lint openapi.yaml and npx @stoplight/prism-cli mock openapi.yaml in SKILL.md.
- [EXTERNAL_DOWNLOADS]: The skill references external sites and downloads packages. * Evidence: Links to documentation on jeffallan.github.io. * Evidence: Use of npx downloads tools from the npm registry.
Recommendations
- CRITICAL: 1 file(s) identified as malware by FileRep - DO NOT USE
- Contains 2 malicious URL(s) - DO NOT USE
Audit Metadata