api-request-builder
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONNO_CODE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user input (method, URL, headers, and payload) to generate code snippets. This provides a surface for indirect prompt injection where malicious input could attempt to bypass constraints during the generation process.
- Ingestion points: The skill accepts externally provided API details as listed in the 'Inputs to request' section of SKILL.md.
- Boundary markers: There are no explicit delimiters or boundary markers defined in the workflow to isolate user-provided data from instructions.
- Capability inventory: The skill does not possess the capability to execute commands, write to the filesystem, or perform network operations; it only generates text examples for the user.
- Sanitization: The 'Quality bar' section requires redacting secrets and using placeholders, which provides a level of protection against credential exposure but does not sanitize against injection attacks.
- [NO_CODE]: The analyzed file is a documentation and instruction file only. No scripts (Python, JavaScript, shell) or binaries were found within the skill package.
Audit Metadata