asyncapi-parser
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to utilize standard Unix utilities, including
wc,grep,awk, andsed, to navigate and extract relevant sections from large AsyncAPI specification files. This approach is a best practice for managing large contexts by reading only the necessary fragments of a document. - [DYNAMIC_EXECUTION]: The skill is designed to generate Drift YAML test definitions. These definitions frequently include
executable-type: commandandexecutable-type: lua-functionblocks, which are intended to reference user-provided shell scripts (e.g., Python) or Lua functions for test triggers and probes. This is a standard feature of the Drift testing framework and is used here for its intended purpose. - [INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection because it processes external, user-supplied AsyncAPI specifications.
- Ingestion points: The agent reads local files (e.g.,
asyncapi.yaml) and resolves external references (e.g.,./messages.yaml) provided by the user. - Boundary markers: There are no specific instructions to use delimiters or ignore instructions embedded within the data of the AsyncAPI files.
- Capability inventory: The skill utilizes shell command execution via the agent's environment to parse and process the files.
- Sanitization: The skill relies on structural parsing of the YAML/JSON content and does not explicitly sanitize the text content of the specification fields.
Audit Metadata