api-test-suite-generator
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFECREDENTIALS_UNSAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill includes hardcoded test credentials ('test@example.com' and 'testpassword') within the
api-client.tshelper script. These are intended for automated authentication testing in a local environment but represent a minor credential exposure pattern. - [COMMAND_EXECUTION]: The CLI utility in
test-gen.tsandgenerate-api-tests.tsutilizesfs.writeFileSyncandfs.mkdirSyncto generate and organize test suites on the user's local file system. This is the primary function of the skill. - [INDIRECT_PROMPT_INJECTION]: The generation logic creates a potential surface for indirect injection by interpolating route definitions directly into TypeScript code templates. 1. Ingestion points: Route definitions extracted from source code. 2. Boundary markers: None. 3. Capability inventory: Local file system writes (
fs.writeFileSync). 4. Sanitization: UsesJSON.stringifyfor request body data but relies on direct interpolation for paths and resource names.
Audit Metadata