asyncapi-parser

Pass

Audited by Gen Agent Trust Hub on Oct 1, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to utilize standard Unix utilities, including wc, grep, awk, and sed, to navigate and extract relevant sections from large AsyncAPI specification files. This approach is a best practice for managing large contexts by reading only the necessary fragments of a document.
  • [DYNAMIC_EXECUTION]: The skill is designed to generate Drift YAML test definitions. These definitions frequently include executable-type: command and executable-type: lua-function blocks, which are intended to reference user-provided shell scripts (e.g., Python) or Lua functions for test triggers and probes. This is a standard feature of the Drift testing framework and is used here for its intended purpose.
  • [INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection because it processes external, user-supplied AsyncAPI specifications.
  • Ingestion points: The agent reads local files (e.g., asyncapi.yaml) and resolves external references (e.g., ./messages.yaml) provided by the user.
  • Boundary markers: There are no specific instructions to use delimiters or ignore instructions embedded within the data of the AsyncAPI files.
  • Capability inventory: The skill utilizes shell command execution via the agent's environment to parse and process the files.
  • Sanitization: The skill relies on structural parsing of the YAML/JSON content and does not explicitly sanitize the text content of the specification fields.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 1, 2026, 09:59 AM