API Tester
Pass
Audited by Gen Agent Trust Hub on Oct 25, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill has a vulnerability surface where malicious instructions could be embedded in the external data it is designed to process.
- Ingestion points: External API responses, third-party documentation, and service-to-service communications (SKILL.md).
- Boundary markers: The instructions lack specific delimiters or commands to the agent to ignore instructions embedded in the external data.
- Capability inventory: The skill utilizes network operations (
fetch) and interacts with testing frameworks like Playwright and k6 (SKILL.md). - Sanitization: There is no mention of sanitizing or validating retrieved data before it is reported or used in subsequent steps.
Audit Metadata