validating-api-responses
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external data sources which could theoretically be manipulated to influence agent behavior.
- Ingestion points: Processes OpenAPI specification files (
openapi.yaml) and captures live API response bodies through middleware. - Boundary markers: Encourages the use of strict validation (
additionalProperties: false) to ensure only documented fields are processed, reducing the attack surface. - Capability inventory: Utilizes standard file system tools (Read, Write) and a scoped execution tool
Bash(api:validate-*)for project scaffolding. - Sanitization: Implements structural validation using the Ajv library, which verifies data types and formats against a pre-defined schema before further processing.
Audit Metadata