api-contract-testing

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt shows and encourages embedding an API key directly in the request (queryParameters: { 'key': YOUR_API_KEY }), which implies placing or outputting secret values verbatim in generated test code/requests.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Required runtime workflow includes Step 4 “整合測試（對真實 API 跑）” which fetches public third-party content from http://api.map.com.tw/net/familyShop.aspx and parses the response JSON/JSONP into jsonList, then passes each json object into familyMartStoreContract.validate(json)—this is outsider-authored free-form response body text from a public web API.