backend-contract-testing
Pass
Audited by Gen Agent Trust Hub on Aug 23, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides comprehensive documentation and implementation patterns for backend contract testing using Pact. It adheres to security best practices by recommending secret management for authentication tokens and utilizing well-known development tools.
- [COMMAND_EXECUTION]: The instructions include standard shell commands for development workflows, such as running tests with
npm test, starting services, and interacting with the Pact Broker CLI (npx pact-broker). These are functional and aligned with the skill's primary purpose. - [EXTERNAL_DOWNLOADS]: The skill utilizes
npxto download and execute official Pact tools from the npm registry. These are well-known services and trusted organizations in the software development ecosystem. - [CREDENTIALS_UNSAFE]: The skill demonstrates proper handling of sensitive data by using placeholders for secrets (e.g.,
${{ secrets.PACT_BROKER_TOKEN }}) and explicitly advising that tokens should be stored in CI secrets rather than hardcoded in the codebase.
Audit Metadata