api-test-bruno
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill exhibits no malicious behavior. It is a utility for API automation that emphasizes secure handling of credentials through environment variables and placeholders. The provided scripts perform deterministic parsing and generation of test assets based on user-supplied documentation.
- [COMMAND_EXECUTION]: The skill provides bash and PowerShell scripts for installation and running tests. These use standard patterns, such as the Bruno CLI (bru) and PowerShell execution policy bypasses, to facilitate local development and CI/CD integration. No unauthorized or hidden command execution was found.
- [INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection because it processes untrusted external data (API specifications). However, this risk is effectively mitigated by the skill's mandatory parsing logic, which uses a strict validation contract to identify gaps and errors in input data. It further requires explicit mapping of security schemes to environment variables, preventing the accidental inclusion of secrets or execution of unverified endpoints.
Audit Metadata