api-cms-strapi
Pass
Audited by Gen Agent Trust Hub on Nov 4, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides comprehensive and secure guidelines for Strapi CMS development, including detailed documentation on the Document Service API, REST API querying, and backend customization patterns.
- [INDIRECT_PROMPT_INJECTION]: The skill acknowledges that processing CMS content involves handling untrusted data. It provides mandatory instructions for the agent to use Strapi's built-in sanitization (
this.sanitizeQuery,this.sanitizeOutput) and validation (this.validateQuery) helpers in custom controllers to prevent unauthorized data exposure and injection vulnerabilities. - [CREDENTIALS_UNSAFE]: No hardcoded credentials or secrets were detected. The skill consistently demonstrates best practices by using environment variables (e.g.,
process.env.STRAPI_URL,process.env.STRAPI_API_TOKEN) for API endpoints and authentication tokens. - [EXTERNAL_DOWNLOADS]: The skill references standard, well-known development tools and libraries, such as the
qspackage for query string parsing and the official@strapi/strapiframework. No suspicious or unverifiable remote code execution patterns were found.
Audit Metadata