api-sdk-generator
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process REST API definitions to generate code, which introduces a vulnerability surface where malicious instructions could be embedded in the input data.
- Ingestion points: The skill processes user-provided REST API specifications, resource names, and endpoint details (found in SKILL.md instructions).
- Boundary markers: There are no explicit instructions or delimiters defined to warn the agent to ignore embedded instructions within the API data.
- Capability inventory: The skill is intended to generate and write multiple source code files (Python, TypeScript, Go) to the local project environment.
- Sanitization: The instructions do not include steps for sanitizing or validating the input API schemas before code generation.
Audit Metadata