api-lifecycle
Pass
Audited by Gen Agent Trust Hub on Mar 3, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill facilitates the transformation of user-provided interview responses into generated OpenAPI specifications and Laravel source code, creating an attack surface for indirect prompt injection.\n
- Ingestion points: Data enters the context via the 'API Discovery Interview' blocks in the
/api designcommand (SKILL.md, Section 1.1).\n - Boundary markers: None. The instructions do not define delimiters or provide warnings to the agent regarding potential instructions embedded within the user data.\n
- Capability inventory: The skill writes multiple PHP files (Controllers, Models, Policies, Migrations) and encourages the execution of these files via the Laravel CLI tool.\n
- Sanitization: None. The prompt does not require the agent to validate or escape the user's input before interpolating it into the generated code templates.\n- [COMMAND_EXECUTION]: The skill instructs the agent to facilitate the execution of local system commands for database management and testing.\n
- Evidence: Instructions in sections 2.9 and 3.5 of SKILL.md prompt the user to execute
php artisan migrateandphp artisan test.
Audit Metadata