apim-policy-authoring
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user requirements to generate API Management policy XML. There is a risk that unsanitized user input could be used to inject malicious logic into the generated XML structure. Ingestion points: User requirements for policy generation (SKILL.md). Boundary markers: Not present. Capability inventory: XML policy generation and MCP documentation tools. Sanitization: Not explicitly instructed.
- [SAFE]: The skill utilizes placeholders like {{TENANT_ID}} and {{API_CLIENT_ID}} instead of hardcoding sensitive credentials.
- [SAFE]: References official Microsoft documentation for policy implementation guidance.
Audit Metadata