Api Patterns
Pass
Audited by Gen Agent Trust Hub on Nov 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from a user-specified project path, which could lead to instructions in those files influencing the agent.
- Ingestion points: The
scripts/api_validator.pyscript accepts a<project_path>as an argument inSKILL.md, indicating it reads and analyzes external files. - Boundary markers: There are no instructions defining delimiters or safety warnings for the agent when processing the results of this analysis.
- Capability inventory: The skill executes a Python script (
scripts/api_validator.py) to analyze project files. - Sanitization: No sanitization or validation of the ingested content is described in the skill instructions.
- [COMMAND_EXECUTION]: The skill defines a command for executing a local script to perform its primary validation task.
- Evidence: The script table in
SKILL.mdspecifies the commandpython scripts/api_validator.py <project_path>.
Audit Metadata