api-patterns
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill includes a local script
scripts/api_validator.pywhich is executed to perform static analysis on API-related files and OpenAPI specifications within a provided project path. - [INDIRECT_PROMPT_INJECTION]: The skill identifies and processes external data from project files, creating an ingestion surface for indirect instructions.
- Ingestion points: The
scripts/api_validator.pyscript reads the contents of source files (e.g., .ts, .js, .py) and configuration files (e.g., openapi.json, swagger.yaml) discovered in the target project directory. - Boundary markers: No explicit delimiters or instructional constraints are utilized to isolate the untrusted file content from the script's execution context.
- Capability inventory: The skill is configured with tools for file manipulation (Read, Write, Edit, Glob, Grep) and has the ability to run Python scripts.
- Sanitization: The script performs no sanitization or filtering of the file contents prior to processing them with regular expressions or JSON parsing.
Audit Metadata