launchpad-dx-apis
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to gather information about external systems (Launchpad applications, case types, and fields) to generate YAML configurations and REST API request bodies. This creates a vulnerability surface where maliciously crafted data from the system or user could attempt to influence the agent's logic.
- Ingestion points: User-provided application schemas and potential data returned from the Launchpad DX API endpoints as described in SKILL.md.
- Boundary markers: None defined. The instructions do not specify the use of delimiters or clear separation between system instructions and untrusted data.
- Capability inventory: The agent is guided to generate YAML files and formulate POST/PATCH/GET API requests based on the ingested metadata.
- Sanitization: The skill lacks guidance on validating, escaping, or sanitizing external content before it is processed by the agent or interpolated into generated documents.
Audit Metadata