api-security-testing
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to ingest and analyze untrusted external data, such as API documentation, endpoint definitions, and parameter schemas, which could be leveraged for indirect prompt injection attacks.
- Ingestion points: The agent is directed to review external API documentation and map data flows in 'SKILL.md'.
- Boundary markers: The workflow includes a mandatory confirmation gate requiring explicit user verification of targets and scopes before performing any active testing.
- Capability inventory: The skill invokes external tools for discovery, fuzzing, and security testing (e.g.,
api-fuzzing-bug-bounty,scanning-tools,idor-testing). - Sanitization: The skill relies on human-in-the-loop confirmation as a primary security control rather than automated input sanitization.
Audit Metadata