The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and parse external, potentially untrusted API definitions to generate executable test scripts. This creates a surface for indirect prompt injection if the provided specifications contain instructions meant to influence the agent's code generation logic.
Ingestion points: OpenAPI 3.x files, Swagger 2.0 definitions, Postman collection exports, raw curl commands, and natural language descriptions provided by the user (SKILL.md).
Boundary markers: The instructions advise the agent to ask for clarification if inputs are ambiguous (Step 1), but they lack explicit delimiters to isolate user-provided data from system instructions during the generation process.
Capability inventory: Across all referenced scripts and templates, the skill generates code for external execution in frameworks like pytest, Jest, JUnit, Go, Newman, and k6. The skill itself does not have the capability to execute commands, write local files, or perform network requests independently.
Sanitization: There are no documented steps for sanitizing or escaping the content of the API definitions before they are interpolated into the prompt for code generation.
[SAFE]: The skill consistently promotes secure practices for handling credentials. The framework templates in reference/framework-templates.md utilize environment variables (os.getenv, process.env, System.getenv) and .env loaders (pytest-dotenv, dotenv) for managing authentication tokens, preventing the inclusion of hardcoded secrets in generated output.
[SAFE]: The skill provides references to TestMu AI HyperExecute, which is a legitimate platform associated with the vendor (lambdatest). This link is provided as a suggested execution environment for the generated tests and does not exhibit malicious redirection or phishing characteristics.

api-to-testcase-generator