mockstar-mock
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill utilizes
bunxto execute the@dhaneshpurohit/mockstarpackage anduvto manage Python dependencies (pypdf,python-docx). It also pulls Docker images fromghcr.io/dhanesh/mockstar. These downloads target official registries (NPM, Docker Hub, PyPI) and the author's own verified tools, which are essential for the skill's functionality. - [COMMAND_EXECUTION]: The skill performs shell operations via
smoke.shandeval/run_eval.pyto automate the generation, enhancement, and verification of mock projects. It usesdocker runto provide a containerized execution environment andcurlto fetch documentation. All shell invocations use properly quoted variables to prevent command injection. - [DYNAMIC_EXECUTION]: The skill generates TypeScript dynamic handlers to support stateful mock behavior. These handlers are generated from templates based on inferred API documentation logic and are designed to be executed by the mockstar runtime during mock serving.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest untrusted external documentation and specifications to generate code. It mitigates indirect prompt injection risks by using a structured JSON intermediate representation (Endpoint Inventory) and producing a comprehensive coverage report (
MOCKSTAR-COVERAGE.md) that explicitly flags all inferred or speculative logic for human review before deployment.
Audit Metadata