audit-fe-api
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements a robust and legitimate workflow for API auditing, including stack discovery and contract validation across frontend and backend codebases.
- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill accesses local
.envand.env.localfiles to identify the dev server port. This access is narrowly scoped to environment discovery and does not involve harvesting or exfiltrating credentials. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from web searches and production logs, which is a potential injection surface.
- Ingestion points: Sentry production error logs via
sentry:search_issuesand Firecrawl web search results viafirecrawl:firecrawl_search. - Boundary markers: Absent.
- Capability inventory: The skill uses read-only tools including
Grep,context7,firecrawl,sentry, andsupabase(restricted to metadata schema queries). It does not have file-write or code-execution capabilities. - Sanitization: None implemented for the ingested external data.
Audit Metadata