offensive-api-security
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze external, untrusted data including source code, binary bundles, and runtime API traces. This workflow lacks explicit instructions for the use of boundary markers or sanitization when processing these inputs, which could allow instructions embedded within the target data to be executed or followed by the agent.
- Ingestion points: The skill performs static code and binary inspection as well as runtime configuration and API trace verification (SKILL.md).
- Boundary markers: No explicit delimiters or warnings to ignore instructions within the analyzed data are specified in the workflow.
- Capability inventory: The skill is capable of performing static/binary analysis, executing search tools (rg), and generating remediation code and automated tests (SKILL.md).
- Sanitization: No sanitization or validation protocols for the external content are documented in the audit checklist.
Audit Metadata