api-documentation-generator
Pass
Audited by Gen Agent Trust Hub on Nov 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external API source code to generate documentation, which represents an ingestion surface for untrusted data that could contain malicious instructions.
- Ingestion points: The agent is instructed to examine the API codebase, including routing, middleware, schemas, and source revision details (SKILL.md, Step 1).
- Boundary markers: The instructions provide specific scope constraints, such as marking missing behavior and avoiding the invention of rate limits or password policies.
- Capability inventory: The skill involves reading local codebase files to generate structured text and OpenAPI specifications.
- Sanitization: The skill explicitly mandates the use of synthetic data and secret placeholders, and it provides specific guidance to omit sensitive capabilities like client-supplied admin roles in documentation unless validated.
Audit Metadata