contract-testing-builder
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external contract specifications (OpenAPI YAML, Pact JSON) in scripts like
tests/contract-validation.test.ts. While standard for contract testing, these files represent a surface for indirect prompt injection if the source files originate from untrusted or attacker-controlled repositories. - [COMMAND_EXECUTION]: Provides templates for executing shell commands within CI environments in
.github/workflows/contract-tests.yml(e.g.,npm run test,npx pact-broker publish). These are standard automation patterns for the intended purpose of continuous integration. - [DATA_EXPOSURE]: Includes a dummy authorization header
Authorization: "Bearer token123"in a mock test case. This is a static placeholder for testing purposes and does not represent a leak of real credentials.
Audit Metadata