api-patterns
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides a utility script,
scripts/api_validator.py, which is intended to be executed by the agent to analyze local project code for API best practices.- [INDIRECT_PROMPT_INJECTION]: The validation script reads the contents of external project files, creating an attack surface where malicious instructions embedded in the code could influence the agent's behavior. - Ingestion points: Files matching API-related patterns are read into memory in
scripts/api_validator.py. - Boundary markers: The script lacks delimiters or 'ignore' instructions for the data it processes.
- Capability inventory: The tool is limited to local file system reads and regex-based analysis.
- Sanitization: There is no filtering or escaping of the ingested file content to mitigate potential prompt injection attacks.
Audit Metadata