api-contract-testing
Pass
Audited by Gen Agent Trust Hub on Oct 31, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external content such as API schemas and sample traffic logs, creating a surface for indirect prompt injection.
- Ingestion points: Untrusted content is ingested via user-supplied OpenAPI schemas, consumer expectations, and sample traffic logs as defined in
prompts/api-contract-testing.md. - Boundary markers: Instructions in
prompts/api-contract-testing.mdandSKILL.mdexplicitly mandate auditing input completeness and credibility, and separating facts from assumptions to mitigate risks. - Capability inventory: The skill does not contain any executable scripts, file system write operations, or network communication capabilities.
- Sanitization: The execution rules in
prompts/api-contract-testing.mdenforce best practices such as least privilege, data masking, and the use of isolated environments when handling sensitive information.
Audit Metadata