detecting-shadow-api-endpoints
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [SAFE]: The skill provides defensive security tools for API discovery and inventory management. The provided Python scripts and shell commands perform localized analysis of log files and configuration data to identify discrepancies between actual traffic and documented specifications.
- [INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted data from API logs and OpenAPI specifications. The ingestion points include web access logs and specification files. The capability inventory is limited to file system read and report generation, with no usage of untrusted data in dangerous sinks. Sanitization is performed through structured parsing and regular expressions for path normalization.
- [COMMAND_EXECUTION]: The skill instructions utilize standard shell utilities for security auditing, including the AWS CLI for infrastructure discovery, grep for source code mining, and yq for YAML processing. These are legitimate tools for the skill's intended purpose of security auditing.
Audit Metadata