api-doc-checker
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads SDK source code from external Git repositories for consistency validation if a local path is not provided via environment variables. These downloads target repositories hosted on platforms like Gitee and GitCode.
- [REMOTE_CODE_EXECUTION]: The skill triggers shell commands, specifically
git clone, to fetch SDK repositories if they are not already available on the local system. This is an automated mechanism for loading required data. - [INDIRECT_PROMPT_INJECTION]: The skill ingests and analyzes untrusted external Markdown documentation files. Ingestion points: Files matching patterns like
js-apis-*.mdandcapi-*.md. Boundary markers: No delimiters or explicit warnings are provided to the agent regarding untrusted input. Capability inventory: Includes network access for cloning, filesystem writes for report generation, and data parsing logic. Sanitization: The logic focuses on reporting issues rather than sanitizing inputs for prompt interpolation. - [DYNAMIC_EXECUTION]: The validation engine dynamically invokes specific logic based on function names defined in the JSON configuration files, such as
checkUnclosedBracesinsyntax-rules.json.
Audit Metadata