public-api-lookup
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Downloads the API catalog from the public-apis repository on GitHub to provide up-to-date search results.
- [INDIRECT_PROMPT_INJECTION]: The skill processes API descriptions from an external source. While the source repository is well-maintained, the ingestion of external data creates a surface for theoretical indirect prompt injection.
- Ingestion point:
scripts/search_apis.pyfetches the README from GitHub. - Boundary markers: Not present.
- Capability inventory: The skill only performs local filtering and display; it lacks tools for command execution or data exfiltration that could be abused by an injection.
- Sanitization: Not applicable as the data is used for display purposes.
Audit Metadata