a6-plugin-fault-injection
Pass
Audited by Gen Agent Trust Hub on Jul 23, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill documentation describes the intended functionality of the Apache APISIX fault-injection plugin. It provides legitimate configuration examples for chaos engineering purposes.
- [COMMAND_EXECUTION]: The skill includes shell command examples using the
a6CLI tool (e.g.,a6 route create). These are standard usage patterns for configuring the APISIX API Gateway and do not involve malicious command injection or unauthorized execution. - [SAFE]: The troubleshooting section correctly identifies and warns users about the security implications of the plugin's execution priority (11000), noting that it runs before authentication. This demonstrates security awareness by encouraging users to use conditional logic (
vars) to prevent unintended authentication bypasses. - [SAFE]: Use of Nginx variables (like
$urior$remote_addr) for response body and header interpolation is a documented feature of the plugin and is handled within the gateway's restricted execution environment.
Audit Metadata