contract-testing
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze external data files, including OpenAPI specifications and Pact consumer contracts, to generate tests and perform validation.
- Ingestion points:
SKILL.mdandreferences/agent-commands.mddefine workflows that read.yamland.jsonfiles representing API contracts. - Boundary markers: The instructions do not define explicit delimiters or warnings to ignore instructions that might be embedded within the processed contract data.
- Capability inventory: The skill utilizes specialized agents (e.g.,
qe-api-contract-validator) that can be influenced by the structure and content of the ingested files. - Sanitization: No specific sanitization or filtering logic is described for the content of the API specifications before they are processed by the agents.
- [COMMAND_EXECUTION]: The skill documentation provides command-line examples for using the
aqeCLI,npx, andcurlto manage contracts and trigger CI/CD webhooks. - [EXTERNAL_DOWNLOADS]: The skill depends on standard, well-known libraries and tools including
@pact-foundation/pact,jq, andnpxfor contract verification and metadata processing.
Audit Metadata