mockstar-mock

Pass

Audited by Gen Agent Trust Hub on Sep 10, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill utilizes bunx to execute the @dhaneshpurohit/mockstar package and uv to manage Python dependencies (pypdf, python-docx). It also pulls Docker images from ghcr.io/dhanesh/mockstar. These downloads target official registries (NPM, Docker Hub, PyPI) and the author's own verified tools, which are essential for the skill's functionality.
  • [COMMAND_EXECUTION]: The skill performs shell operations via smoke.sh and eval/run_eval.py to automate the generation, enhancement, and verification of mock projects. It uses docker run to provide a containerized execution environment and curl to fetch documentation. All shell invocations use properly quoted variables to prevent command injection.
  • [DYNAMIC_EXECUTION]: The skill generates TypeScript dynamic handlers to support stateful mock behavior. These handlers are generated from templates based on inferred API documentation logic and are designed to be executed by the mockstar runtime during mock serving.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest untrusted external documentation and specifications to generate code. It mitigates indirect prompt injection risks by using a structured JSON intermediate representation (Endpoint Inventory) and producing a comprehensive coverage report (MOCKSTAR-COVERAGE.md) that explicitly flags all inferred or speculative logic for human review before deployment.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 10, 2026, 07:07 PM
Security Audit — agent-trust-hub — mockstar-mock