api-client-tester-waruna834
Pass
Audited by Gen Agent Trust Hub on Jul 1, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONCREDENTIALS_UNSAFEPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill's installation section references an external GitHub repository (github.com/waruna834/API_Client___Tester.git) for obtaining the full source code and tool executable.
- [COMMAND_EXECUTION]: Documentation provides shell commands for environment setup and execution, including 'git clone', 'pip install', and running the Python main script.
- [CREDENTIALS_UNSAFE]: The 'CollectionManager' component implements functionality to save API request data, including sensitive authentication headers and tokens, into plain-text JSON files within the './collections' directory.
- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface through the 'import_collection' feature. It ingests untrusted external JSON data (SKILL.md), lacks explicit boundary markers or 'ignore' instructions for the agent, possesses network request and file-write capabilities, and does not perform validation or sanitization of the imported request payloads.
Audit Metadata