The Agent Skills Directory

Indirect Prompt Injection (HIGH): The skill's stated purpose is to generate API clients based on external inputs (API integration patterns, schemas, third-party webhooks). Because the skill is granted high-privilege capabilities including Bash, Write, and Edit, it is vulnerable to indirect prompt injection where an attacker-controlled schema could manipulate the agent into executing arbitrary code or modifying the file system.
Ingestion points: Processes external API specifications, webhook definitions, and third-party integration patterns.
Boundary markers: None present; the skill lacks instructions for the agent to distinguish between data and instructions within processed schemas.
Capability inventory: Granted Bash, Write, Edit, Read, and Grep permissions.
Sanitization: No sanitization, validation, or schema-enforcement logic is provided to mitigate malicious content in the processed data.
No Executable Code (INFO): The submitted skill contains only a markdown definition file. No scripts (.py, .js, .sh) or configuration files were provided for a behavioral analysis of the implementation.

api-client-generator