qa-contract-validate
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references standard tools from official sources. It mentions using 'oasdiff/oasdiff-action' with pinned SHAs and installing 'oasdiff' via Go or Homebrew. These are well-known tools used for API contract testing.
- [COMMAND_EXECUTION]: The skill uses
npx,go, andpipto execute validation tools. It specifically includes a safety measure usingnpx --no-installduring preflight checks to prevent the automatic installation of unknown packages without the user's knowledge. - [PRIVILEGE_ESCALATION]: No privilege escalation patterns (like
sudoorchmod 777) were detected. The skill operates within designated output directories ($JAAN_OUTPUTS_DIR). - [PROMPT_INJECTION]: The skill does not contain instructions to bypass safety filters or ignore previous instructions. It follows a structured multi-phase execution protocol with a mandatory human review step.
- [DATA_EXFILTRATION]: No exfiltration patterns to non-whitelisted domains were found. The skill processes local OpenAPI specifications and outputs results to local directories.
Audit Metadata