api-handoff-docs
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEPROMPT_INJECTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill uses role-play instructions (e.g., 'You are a backend developer') and strong formatting constraints ('No Chat Output', 'No discussion, no explanation'). These are utilized to ensure the agent produces only a structured documentation file rather than conversational responses, which is consistent with the skill's utility purpose.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data (local source code and business context) to generate documentation.
- Ingestion points: The agent reads local files containing API code, controllers, services, and DTOs.
- Boundary markers: None explicitly defined in the instructions to separate code analysis from documentation generation.
- Capability inventory: The skill uses the ability to write files to the
.claude/docs/ai/directory. - Sanitization: There is no explicit sanitization of the code content before it is placed into the markdown template.
Audit Metadata