The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill references the installation of hurl via standard system package managers (choco, brew) and schemathesis via pip. These are established, legitimate tools in the API testing ecosystem.
[COMMAND_EXECUTION]: Provides command-line examples for executing hurl and schemathesis to test API endpoints. These commands are typical for the skill's stated utility and do not include suspicious flags or escalated privileges.
[PROMPT_INJECTION]: The skill exposes an indirect prompt injection surface by processing user-provided API endpoints or specifications.
Ingestion points: The <endpoint-or-spec> argument and the OpenAPI JSON endpoint processed by schemathesis in SKILL.md.
Boundary markers: None present in the instructions to separate untrusted specification data from agent logic.
Capability inventory: Use of hurl and schemathesis CLI tools which perform network requests based on the provided data.
Sanitization: None detected; the skill assumes the provided specification or endpoint is trusted for testing purposes.
[SAFE]: No obfuscation, data exfiltration, or persistence mechanisms were found. The skill operates within the expected scope of an API testing utility using well-known third-party dependencies.

api-test