easy-yapi-assistant
Pass
Audited by Gen Agent Trust Hub on Nov 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill utilizes local shell scripts (
scripts/) to introspect the project environment using standard commands likegrep,awk, andcat. These tools are restricted to reading project-related files and do not perform unauthorized network operations or data exfiltration. - [INDIRECT_PROMPT_INJECTION]: The skill ingests project source code and configuration files to provide context-aware rule suggestions. While this creates a potential surface for instructions embedded in code comments to influence the agent, the skill mitigates this by strictly requiring user review and approval of generated diffs before any file modifications are applied.
- [SAFE]: Generated rule templates and documentation consistently promote safe handling of sensitive information by using environment variable references (e.g.,
${apiKey},${Authorization}) instead of hardcoded secrets. - [SAFE]: External references are limited to well-known vendor resources (e.g.,
github.com/tangcent/easy-yapi) used for documentation and manual installation instructions, posing no security risk.
Audit Metadata