api-doc-generator
Pass
Audited by Gen Agent Trust Hub on Jun 21, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface (Category 8) because it processes external data that is later reflected in the agent's context.
- Ingestion points: The
scripts/generate_docs.pyscript ingests untrusted data from OpenAPI/OAS specification files (YAML/JSON). - Boundary markers: The generated markdown documentation lacks boundary markers or instructions to the agent to treat content from the specification as untrusted data.
- Capability inventory: The skill can perform file system operations, specifically creating directories and writing multiple markdown files.
- Sanitization: The script interpolates content from the specification fields (such as
description,summary, andexample) directly into markdown files without sanitization or escaping. - [SAFE]: The script uses
yaml.safe_load()for parsing specification files, which is a security best practice that prevents arbitrary code execution during YAML deserialization. - [SAFE]: The skill performs local file operations (reading a spec and writing documentation) that are consistent with its stated purpose as an API documentation generator.
Audit Metadata