api-contracts
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides architectural guidelines for managing API contracts and explicitly advises against including sensitive information like credentials or database details in the public contracts.
- [INDIRECT_PROMPT_INJECTION]: The skill describes a workflow that ingests external OpenAPI contracts, creating an attack surface for indirect prompt injection. However, it recommends standard development practices such as runtime validation and testing against published schemas to mitigate risks associated with external data.
- Ingestion points: OpenAPI schema files (YAML/JSON) and documentation files (SKILL.md)
- Boundary markers: None explicitly defined to separate instructions from data content.
- Capability inventory: Execution of project commands such as
pnpm api:generateandapi:check, file reading, and code generation (SKILL.md). - Sanitization: Includes instructions to parse unknown external data and verify HTTP responses against published schemas.
Audit Metadata