api-versioning
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONNO_CODE
Full Analysis
- [NO_CODE]: The skill consists entirely of Markdown documentation and does not include any scripts, executable files, or configuration assets.\n- [SAFE]: The instructions describe standard security auditing techniques for identifying shadow APIs, which is a recognized category in the OWASP API Security Top 10 (API9:2023).\n- [INDIRECT_PROMPT_INJECTION]: The methodology involves mining external sources like mobile apps, JavaScript bundles, and public documentation. Processing these untrusted sources represents a potential attack surface for indirect prompt injection, though no automated logic is provided to exploit this surface.\n
- Ingestion points: External sources including mobile apps, JS bundles, and public API documentation mentioned in the 'Method' section of SKILL.md.\n
- Boundary markers: Absent; there are no instructions provided to delimit or ignore instructions within the processed data.\n
- Capability inventory: Mentions the use of Burp Suite and ffuf for API testing.\n
- Sanitization: No sanitization or validation logic is defined for the ingestion of external data.
Audit Metadata