The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads the RESTler tool from Microsoft's official GitHub repository (github.com/microsoft/restler-fuzzer). This is a trusted source and the operation is a standard part of the tool's installation procedure as documented in the workflow.
[COMMAND_EXECUTION]: The orchestration script in scripts/agent.py executes the RESTler binary using subprocess.run with argument lists. This implementation avoids shell command injection risks by not passing raw strings to a shell interpreter, ensuring that target-specific inputs cannot escalate into unintended command execution.
[INDIRECT_PROMPT_INJECTION]: The skill processes external OpenAPI specifications and test results, creating a potential ingestion surface for untrusted data from the target API or its documentation.
Ingestion points: The api_spec parameter in scripts/agent.py and the runSummary.json file in the results directory.
Boundary markers: No explicit delimiter-based boundary markers are used in the parsing logic to distinguish between data and instructions.
Capability inventory: The script's capabilities are restricted to local file operations and execution of the specific RESTler binary with defined flags.
Sanitization: The script relies on standard JSON parsing (json.load), which treats the input strictly as data, minimizing the risk that instructions embedded in a malicious API spec could influence the agent's core logic.
[CREDENTIALS_UNSAFE]: Documentation in SKILL.md includes example credentials (e.g., fuzzer@test.com / FuzzerPass123!). These are clearly labeled as mock data for use in a test/staging environment and do not represent a leak of production secrets.

performing-api-fuzzing-with-restler