api-documentation
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses
npxto execute@apidevtools/swagger-cli, which involves downloading the package from the npm registry at runtime for documentation validation purposes. - [COMMAND_EXECUTION]: Utilizes multiple shell commands including
git,grep,sed,find, andyqto analyze the filesystem and compare endpoint definitions extracted from code and documentation files. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from source code files and documentation files to extract API endpoints for comparison.
- Ingestion points: Project source code (e.g.,
routes/*.ts) and API documentation files (e.g.,openapi.yaml) as specified in the logic for Step 1 and Step 3. - Boundary markers: None; the skill uses
grepandseddirectly on file contents. - Capability inventory: Relies on
Bash,Read,Grep,Glob,Edit, andWritetools to process data and interact with the filesystem. - Sanitization: Does not sanitize the extracted endpoint strings before comparison or output.
Audit Metadata