agency-api-tester
Pass
Audited by Gen Agent Trust Hub on Aug 11, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to interact with and process data from external API endpoints. While this creates a theoretical surface for indirect prompt injection if an API response contains malicious instructions, the skill includes explicit instructions for the agent to validate and test for such vulnerabilities (e.g., input sanitization and SQL injection).
- [DATA_EXPOSURE]: The provided code examples demonstrate accessing configuration through environment variables (e.g.,
process.env.TEST_USER_PASSWORD). This is a recommended security practice for managing secrets in testing environments and does not constitute a hardcoded credential risk. - [DYNAMIC_EXECUTION]: The skill generates automated test scripts using established frameworks like Playwright. This behavior is consistent with the primary purpose of an API testing tool and follows standard software development patterns.
Audit Metadata