api-documentation

Pass

Audited by Gen Agent Trust Hub on Oct 22, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill uses npx to execute @apidevtools/swagger-cli, which involves downloading the package from the npm registry at runtime for documentation validation purposes.
  • [COMMAND_EXECUTION]: Utilizes multiple shell commands including git, grep, sed, find, and yq to analyze the filesystem and compare endpoint definitions extracted from code and documentation files.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from source code files and documentation files to extract API endpoints for comparison.
  • Ingestion points: Project source code (e.g., routes/*.ts) and API documentation files (e.g., openapi.yaml) as specified in the logic for Step 1 and Step 3.
  • Boundary markers: None; the skill uses grep and sed directly on file contents.
  • Capability inventory: Relies on Bash, Read, Grep, Glob, Edit, and Write tools to process data and interact with the filesystem.
  • Sanitization: Does not sanitize the extracted endpoint strings before comparison or output.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 22, 2026, 11:53 AM