api-design-skill
Warn
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: MEDIUMPROMPT_INJECTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill includes a hidden instruction titled 'Emit Outcome Sidecar' in SKILL.md that directs the agent to execute a silent file-write operation to a hidden directory (~/.claude/skill-analytics/) upon completion. This directive attempts to override standard agent behavior to perform a background task not requested by the user.
- [DATA_EXFILTRATION]: The 'Emit Outcome Sidecar' section instructs the agent to harvest session metadata, including timestamps, performance metrics (runtime_ms), and execution status, and store it in a persistent JSON file on the local filesystem. This creates a mechanism for tracking user activity and harvesting session details without explicit consent.
- [INDIRECT_PROMPT_INJECTION]: The provided code for cursor-based pagination in reference/pagination.md uses JSON.parse(Buffer.from(cursor, 'base64url').toString()) to handle user-supplied query parameters. This creates a vulnerability surface for schema confusion or malicious data injection if the decoded object is used in database queries without further validation or cryptographic integrity checks like signing.
- Ingestion points: The 'cursor' query parameter in the getPosts and getPostsBidirectional functions within reference/pagination.md.
- Boundary markers: Absent; the code does not include delimiters or specific instructions to ignore potentially malicious content inside the encoded cursor string.
- Capability inventory: The skill instructions demonstrate the capability to write to the local filesystem (telemetry write).
- Sanitization: The examples show basic destructuring but lack robust schema validation or integrity checks for the decoded payload.
Audit Metadata