uw-analyze-api
Pass
Audited by Gen Agent Trust Hub on Oct 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill operates as a passive analysis tool, extracting API definitions and security logic into a local documentation folder. It does not initiate network connections or attempt to execute remote scripts.
- [INDIRECT_PROMPT_INJECTION]: The skill defines a process to read and document external files such as source code and API specifications, which introduces a vulnerability surface.
- Ingestion points: Source code files (.java, .ts, .ts, etc.) and API specs (OpenAPI, AsyncAPI, GraphQL) found via glob and grep.
- Boundary markers: None; the instructions do not provide delimiters or warnings to ignore instructions embedded in the analyzed code.
- Capability inventory: Write and Edit tools restricted to the docs/unwind/** directory.
- Sanitization: None; the skill explicitly requires including 'COMPLETE specs' and 'actual code', which may contain malicious instructions if the codebase is untrusted.
Audit Metadata