api-testing
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill generates Python (pytest) and JavaScript (k6) scripts based on OpenAPI specifications and user-defined schemas, which are then executed. This is the core functionality of the skill. Evidence: SKILL.md ('脚本编写') and references/k6-conventions.md ('最小脚本模板') describe generating and running scripts using pytest and k6 run.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data (OpenAPI/Swagger documents and schemas) to generate test logic, creating a surface for potential injection. 1. Ingestion points: OpenAPI/Swagger files and test case schemas. 2. Boundary markers: Absent. 3. Capability inventory: File writing (scripts, reports) and command execution (pytest, k6). 4. Sanitization: Absent.
- [COMMAND_EXECUTION]: The skill invokes system commands to run the generated test suites and validation tools. Evidence: Instructions specify running 'pytest api-tests/', 'k6 run', and 'schemathesis run'.
Audit Metadata