typespec-create-api-plugin
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references standard TypeSpec libraries including
@typespec/http,@typespec/openapi3, and@microsoft/typespec-m365-copilot. These are official, well-known packages used for API modeling and Copilot agent development. - [CREDENTIALS_UNSAFE]: The skill provides templates for configuring authentication (API Key, OAuth2). All sensitive fields such as URLs, scopes, and keys use placeholder values (e.g.,
registration-id-here,https://oauth.example.com/authorize) intended to be filled by the developer during the generation process. - [COMMAND_EXECUTION]: No shell commands, system calls, or script execution patterns were identified. The skill acts exclusively as a code generation assistant.
- [INDIRECT_PROMPT_INJECTION]: The skill includes instructions for generating agent metadata and user-facing instructions (
@instructions,@reasoning,@responding). It correctly suggests using confirmation dialogs (@capabilities) for destructive or critical operations, which is a recommended security boundary for AI-driven actions. - [OBFUSCATION]: The content was analyzed for hidden characters, zero-width spaces, and homoglyphs. No obfuscation techniques were detected.
Audit Metadata