automating-api-testing
Warn
Audited by Gen Agent Trust Hub on Jul 21, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The
scripts/generate_test_suite.pyscript contains functionality to generate shell scripts from provided content and apply executable permissions usingchmod(0o755). This dynamic code generation allows the agent to create and run arbitrary bash scripts.\n- [PROMPT_INJECTION]: The skill presents an indirect prompt injection surface through the ingestion of external data.\n - Ingestion points: The skill instructions in
SKILL.mddirect the agent to parse external OpenAPI and GraphQL specification files.\n - Boundary markers: There are no explicit delimiters or instructions for the agent to treat the content of these specifications as data rather than instructions.\n
- Capability inventory: The skill has the capability to write files, modify permissions, and execute shell commands via the
Bashtool.\n - Sanitization: The skill does not implement or describe any sanitization or validation of the data extracted from API specifications before it is used for code generation.
Audit Metadata