contract-testing

Pass

Audited by Gen Agent Trust Hub on Apr 7, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides instructions for installing and executing various command-line tools used in contract testing workflows.
  • Includes installation and execution commands for prism-cli (Stoplight), dredd, and oasdiff (Tufin).
  • Demonstrates the use of the pact-broker CLI for publishing pacts and running deployment gate checks.
  • Includes GitHub Actions workflows that execute these tools in a CI environment.
  • [EXTERNAL_DOWNLOADS]: The skill references several external dependencies and tools from well-known services and organizations.
  • Fetches the oasdiff tool from the Tufin GitHub repository via go install and brew.
  • Utilizes standard Node.js packages such as @pact-foundation/pact, @stoplight/prism-cli, dredd, and ajv from the NPM registry.
  • Uses the official actions/checkout@v4 GitHub Action and pactfoundation/pact-broker Docker image.
  • [SAFE]: No malicious patterns, obfuscation, or unauthorized data access were detected. The skill follows security best practices by recommending the use of environment variables (e.g., PACT_BROKER_TOKEN) and GitHub Secrets for managing sensitive credentials rather than hardcoding them.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 7, 2026, 10:29 AM
Security Audit — agent-trust-hub — contract-testing