api-security
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The script 'scripts/api-security-scan.sh' executes shell commands such as 'docker', 'curl', and 'mkdir' to facilitate automated security testing. These tools are used standardly to generate reports and verify API configurations such as rate limiting and CORS policies.\n- [UNVERIFIABLE_DEPENDENCIES_AND_REMOTE_CODE_EXECUTION]: The skill facilitates the pulling and execution of the 'owasp/zap2docker-stable' Docker image for automated vulnerability scanning. As this resource is provided by a well-known security organization (OWASP), the download and execution are considered safe and represent standard industry practice for the skill's stated purpose.\n- [INDIRECT_PROMPT_INJECTION]: The 'scripts/api-security-scan.sh' script processes external URLs and file paths, defining a potential surface for indirect prompt injection if an agent were to process the scan results autonomously. However, this is a standard risk for security tools.\n
- Ingestion points: The 'API_URL' and 'OPENAPI_SPEC' parameters in 'scripts/api-security-scan.sh'.\n
- Boundary markers: Absent within the shell script.\n
- Capability inventory: The script utilizes 'docker run', 'curl', and file system write operations.\n
- Sanitization: Input variables are double-quoted to mitigate word-splitting in the shell environment.
Audit Metadata