integrate-webapi

Pass

Audited by Gen Agent Trust Hub on Oct 25, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • Indirect Prompt Injection Surface: The skill analyzes local source code and user-provided input to identify integration points.
  • Ingestion points: Phase 2 uses an explore agent to read source code files (src/**/*.{ts,tsx,js,jsx,vue,astro}) and data model manifests. Phase 6.2 processes user-provided Mermaid diagrams or text descriptions.
  • Boundary markers: The skill uses structured prompts when delegating tasks to sub-agents, though it does not explicitly use 'ignore embedded instructions' delimiters for all file content.
  • Capability inventory: The skill uses the Bash tool to run local scripts, build the project (npm run build), and commit changes to git. It also uses Write and Edit tools to modify source and configuration files.
  • Sanitization: A dedicated validation script (scripts/validate-webapi-integration.js) verifies the generated integration files and their schemas post-integration.
  • Command Execution: The skill utilizes the Bash tool for standard development operations.
  • Evidence: Executes local Node.js scripts (e.g., detect-project-context.js, create-table-permission.js) located within the plugin directory.
  • Evidence: Runs the project's build process (npm run build) to catch errors and uses git for version control (git commit).
  • Tool and Skill Delegation: The skill orchestrates multiple sub-agents and external skills to perform complex tasks.
  • Evidence: Invokes specialized agents for exploration, code integration, and security architecture.
  • Evidence: Calls external skills like /deploy-site and /add-ai-webapi to handle deployment and specialized AI read paths.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 25, 2026, 04:05 AM