api-security-tester
Pass
Audited by Gen Agent Trust Hub on Aug 8, 2026
Risk Level: SAFEPROMPT_INJECTIONNO_CODE
Full Analysis
- [NO_CODE]: The skill contains only markdown instructions and configuration metadata. There are no scripts, binaries, or automated installation processes included in the package.
- [PROMPT_INJECTION]: The skill instructs the agent to analyze external, untrusted API endpoints and documentation, which introduces a surface for indirect prompt injection where an attacker-controlled API could influence agent behavior.
- Ingestion points: The instructions specify testing for "REST endpoints", "GraphQL APIs", "WebSocket APIs", and "API docs" (SKILL.md).
- Boundary markers: The skill does not provide instructions to use delimiters or to ignore instructions embedded within the data retrieved from external sources.
- Capability inventory: The skill configuration enables the use of
codebaseandfilesystemtools. - Sanitization: No explicit sanitization, filtering, or validation steps are defined for processing external network data.
Audit Metadata