api-doc-gen
Pass
Audited by Gen Agent Trust Hub on Mar 25, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill requests the
Bashtool to facilitate scanning the codebase for routing patterns and handler definitions. The instructions scope this tool's use to standard search operations likegrepandglobfor identifying framework-specific registration patterns (Fiber, Echo, Chi, Gin). - [INDIRECT_PROMPT_INJECTION]: The skill's primary workflow involves reading untrusted data (source code and developer comments). Specifically, Priority 1 for extracting business logic involves verbatim transcription of
Step N:lines from usecase header comments. While this presents an attack surface where a malicious actor could embed instructions in comments, the skill mitigates this by enforcing strict deterministic rules: the agent is explicitly told to transcribe the content verbatim and is prohibited from reinterpreting, merging, or adding steps. This minimizes the risk of the agent following instructions contained within the processed data.
Audit Metadata