engineering-rest-api-design
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill includes a 'Review mode' designed to audit existing API contracts and code. This creates a vulnerability surface where instructions embedded in the analyzed source code (such as in comments or string literals) could attempt to influence the agent's behavior.
- Ingestion points: The skill uses the
Readtool to access and analyze existing API implementations and specifications. - Boundary markers: The instructions do not define specific delimiters or instructions to treat the ingested code strictly as data.
- Capability inventory: The skill is permitted to use
Read,Edit,Write, andBash(git:*)tools, providing broad access to the local environment. - Sanitization: There are no explicit instructions for the agent to sanitize or validate the content of the files it reviews.
- [SAFE]: The skill references authoritative API design documentation from well-known services and organizations, including Microsoft's REST API Guidelines on GitHub and Google's API Design Guide. These references are used for documentation purposes and do not involve remote code execution.
Audit Metadata