api-publish
Pass
Audited by Gen Agent Trust Hub on May 19, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads the 'ap' CLI and Gateway distribution from 'https://github.com/wso2/api-platform/releases'. These are official vendor resources and originate from a trusted organization.
- [COMMAND_EXECUTION]: The skill executes several bash and node scripts to automate setup. 'scripts/install-ap-cli.sh' installs the CLI to the local path and modifies shell profiles to update the PATH. 'scripts/setup-gateway.sh' manages Docker Compose stacks. These operations are standard for a development tool management skill.
- [CREDENTIALS_UNSAFE]: 'scripts/init-local-cli-config.js' hardcodes 'admin/admin' credentials for the local gateway. As noted in the script's documentation, these are the public default credentials shipped with the software for local development and do not represent a compromise of user-supplied secrets.
- [DATA_EXFILTRATION]: While the skill interacts with external URLs for documentation and downloads, these are limited to WSO2's official GitHub and PolicyHub repositories for configuration and documentation purposes.
Audit Metadata